@faable/auth-sdk 2.7.61 → 2.7.63

package/dist/api/types.d.ts

@@ -1109,11 +1109,7 @@ export interface paths {
          */
         get: operations["rolemember/list"];
         put?: never;
-        /**
-         * Create Rolemember
-         * @description Create Rolemember
-         */
-        post: operations["rolemember/create"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
@@ -1180,7 +1176,11 @@ export interface paths {
          * @description Get Team
          */
         get: operations["team/get"];
-        put?: never;
+        /**
+         * Create or update a Team with a given id
+         * @description Creates the Team with the given id if it does not exist in this tenant (201), or updates its name, description, metadata and — when given — slug (200). Idempotent. Needs both `create:teams` and `update:teams`. `team_id_unavailable` (409) when the id cannot be used in this tenant; `already_exists` when the slug is taken by another team.
+         */
+        put: operations["team/put"];
         /**
          * Update Team
          * @description Update Team
@@ -1209,11 +1209,7 @@ export interface paths {
          */
         get: operations["teammember/list"];
         put?: never;
-        /**
-         * Create Teammember
-         * @description Create Teammember
-         */
-        post: operations["teammember/create"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
@@ -1288,6 +1284,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/member/{user_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Change a Team member's roles
+         * @description Replaces the roles a User holds within the given Team. Every role must be a Role of this tenant. Emits `team.member.updated` when the roles actually change, and leaves an entry in the tenant's log.
+         */
+        post: operations["team/updateMember"];
+        /**
+         * Remove a User from a Team
+         * @description Removes the User's membership of the given Team (the User itself is not deleted). Emits `team.member.removed` and leaves an entry in the tenant's log.
+         */
+        delete: operations["team/removeMember"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/team/{team_id}/invite": {
         parameters: {
             query?: never;
@@ -1717,6 +1737,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/notificationsubscription/{notificationsubscription_id}/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test event to a webhook
+         * @description Sends a signed `ping` event to the subscription URL right now and returns the outcome. The request is signed exactly like a real delivery (`x-faable-signature`, `x-faable-timestamp`, `x-faable-delivery`), with `payload: { subscription_id }`. It is not retried and is recorded in the Log as `webhook.ping`. A successful test sets a `failing` subscription back to `healthy`. Works on inactive subscriptions too.
+         */
+        post: operations["notificationsubscription/test"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/notificationsubscription/{notificationsubscription_id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate a webhook's signing secret
+         * @description Replaces the signing secret with a new one (generated, or the one in the body) and keeps the previous one valid for 24 hours. During that overlap every delivery carries two signatures, `x-faable-signature: sha256=<new>,sha256=<previous>`, so receivers can switch to the new secret at their own pace: accept a delivery when any of the signatures matches. The new secret is returned only in this response. Rotating again during an overlap drops the oldest secret.
+         */
+        post: operations["notificationsubscription/rotateSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/notificationsubscription/{notificationsubscription_id}/deliveries/{delivery_id}/redeliver": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeliver a webhook delivery
+         * @description Queues a past delivery (succeeded, failed or still retrying) to be sent again within the next few seconds, with the same event id (`x-faable-delivery`) and a fresh retry schedule (1 min, 5 min, 30 min, 2 h, 12 h on timeouts, network errors, 5xx and 429). The delivery id is `data.delivery_id` in the `webhook.<event>` Log rows. Deliveries are kept for 30 days after they finish.
+         */
+        post: operations["notificationsubscription/redeliver"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/log": {
         parameters: {
             query?: never;
@@ -5417,16 +5497,6 @@ export interface components {
         RoleMemberMetadata: {
             [key: string]: unknown;
         };
-        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
-        RoleMemberCreate: {
-            /**
-             * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
-             * @example [
-             *       "user_6555fd293acc2f0fac0e3452"
-             *     ]
-             */
-            users: string[];
-        };
         /** @description Team */
         Team: {
             /** @description Team ID */
@@ -5530,24 +5600,6 @@ export interface components {
         TeamMemberMetadata: {
             [key: string]: unknown;
         };
-        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
-        TeamMemberCreate: {
-            /**
-             * @description List of User ids to add as members of the team. Users already in the team are skipped.
-             * @example [
-             *       "user_6555fd293acc2f0fac0e3452"
-             *     ]
-             */
-            users: string[];
-            /**
-             * @description Role ids to grant to the added members within the scope of this team.
-             * @default []
-             * @example [
-             *       "role_6555fd293acc2f0fac0e3452"
-             *     ]
-             */
-            roles: string[];
-        };
         /** @description A permission exposed by an API: a single value that may end up in the `permissions` claim of an access_token, plus a human-readable description shown in the consent prompt. */
         Permission: {
             /**
@@ -5944,6 +5996,26 @@ export interface components {
         } | {
             /** @description NotificationSubscriptionWebhook ID */
             id: string;
+            /**
+             * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+             *
+             *     - `user.created`: A user was created (signup, import or Management API).
+             *     - `user.updated`: A user was updated.
+             *     - `user.deleted`: A user was deleted.
+             *     - `auth.login`: A user logged in.
+             *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+             *     - `team.created`: A team was created.
+             *     - `team.updated`: A team was updated.
+             *     - `team.deleted`: A team was deleted.
+             *     - `team.member.added`: A user was added to a team.
+             *     - `team.member.updated`: A team member's roles changed.
+             *     - `team.member.removed`: A user was removed from a team (or left it).
+             *     - `team.invite.created`: An invitation to join a team was created.
+             *     - `team.invite.revoked`: A pending team invitation was revoked.
+             *     - `team.invite.accepted`: A team invitation was accepted.
+             *
+             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             */
             events: string[];
             /** @enum {string} */
             channel: "webhook";
@@ -5955,9 +6027,22 @@ export interface components {
                  * @description Webhook URL
                  */
                 url: string;
-                /** @description Secret used to sign the webhook payload */
-                secret: string;
+                /**
+                 * Format: date-time
+                 * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                 */
+                previous_secret_expires_at?: string;
             };
+            /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+            status?: "healthy" | "failing";
+            /** @description Failed delivery attempts since the last success. */
+            consecutive_failures?: number;
+            /** Format: date-time */
+            last_failure_at?: string;
+            /** Format: date-time */
+            last_success_at?: string;
+            /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+            secret?: string;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -6012,6 +6097,26 @@ export interface components {
         NotificationSubscriptionWebhook: {
             /** @description NotificationSubscriptionWebhook ID */
             id: string;
+            /**
+             * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+             *
+             *     - `user.created`: A user was created (signup, import or Management API).
+             *     - `user.updated`: A user was updated.
+             *     - `user.deleted`: A user was deleted.
+             *     - `auth.login`: A user logged in.
+             *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+             *     - `team.created`: A team was created.
+             *     - `team.updated`: A team was updated.
+             *     - `team.deleted`: A team was deleted.
+             *     - `team.member.added`: A user was added to a team.
+             *     - `team.member.updated`: A team member's roles changed.
+             *     - `team.member.removed`: A user was removed from a team (or left it).
+             *     - `team.invite.created`: An invitation to join a team was created.
+             *     - `team.invite.revoked`: A pending team invitation was revoked.
+             *     - `team.invite.accepted`: A team invitation was accepted.
+             *
+             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             */
             events: string[];
             /** @enum {string} */
             channel: "webhook";
@@ -6023,9 +6128,22 @@ export interface components {
                  * @description Webhook URL
                  */
                 url: string;
-                /** @description Secret used to sign the webhook payload */
-                secret: string;
+                /**
+                 * Format: date-time
+                 * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                 */
+                previous_secret_expires_at?: string;
             };
+            /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+            status?: "healthy" | "failing";
+            /** @description Failed delivery attempts since the last success. */
+            consecutive_failures?: number;
+            /** Format: date-time */
+            last_failure_at?: string;
+            /** Format: date-time */
+            last_success_at?: string;
+            /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+            secret?: string;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -6046,8 +6164,11 @@ export interface components {
              * @description Webhook URL
              */
             url: string;
-            /** @description Secret used to sign the webhook payload */
-            secret: string;
+            /**
+             * Format: date-time
+             * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+             */
+            previous_secret_expires_at?: string;
         };
         /**
          * @description NotificationSubscriptionWebhookMetadata
@@ -6071,6 +6192,26 @@ export interface components {
                 [key: string]: unknown;
             };
         } | {
+            /**
+             * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+             *
+             *     - `user.created`: A user was created (signup, import or Management API).
+             *     - `user.updated`: A user was updated.
+             *     - `user.deleted`: A user was deleted.
+             *     - `auth.login`: A user logged in.
+             *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+             *     - `team.created`: A team was created.
+             *     - `team.updated`: A team was updated.
+             *     - `team.deleted`: A team was deleted.
+             *     - `team.member.added`: A user was added to a team.
+             *     - `team.member.updated`: A team member's roles changed.
+             *     - `team.member.removed`: A user was removed from a team (or left it).
+             *     - `team.invite.created`: An invitation to join a team was created.
+             *     - `team.invite.revoked`: A pending team invitation was revoked.
+             *     - `team.invite.accepted`: A team invitation was accepted.
+             *
+             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             */
             events: string[];
             /** @enum {string} */
             channel: "webhook";
@@ -6079,11 +6220,11 @@ export interface components {
             config: {
                 /**
                  * Format: uri
-                 * @description Webhook URL
+                 * @description Webhook URL. Must be `https`. Deliveries to private, loopback, link-local or metadata addresses are refused at delivery time.
                  */
                 url: string;
-                /** @description Secret used to sign the webhook payload */
-                secret: string;
+                /** @description Secret used to sign the webhook payload. Optional: when omitted one is generated and returned once, in the `secret` field of the response. */
+                secret?: string;
             };
             /** @description Add Metadata */
             metadata?: {
@@ -6114,6 +6255,26 @@ export interface components {
         };
         /** @description NotificationSubscriptionWebhookCreate */
         NotificationSubscriptionWebhookCreate: {
+            /**
+             * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+             *
+             *     - `user.created`: A user was created (signup, import or Management API).
+             *     - `user.updated`: A user was updated.
+             *     - `user.deleted`: A user was deleted.
+             *     - `auth.login`: A user logged in.
+             *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+             *     - `team.created`: A team was created.
+             *     - `team.updated`: A team was updated.
+             *     - `team.deleted`: A team was deleted.
+             *     - `team.member.added`: A user was added to a team.
+             *     - `team.member.updated`: A team member's roles changed.
+             *     - `team.member.removed`: A user was removed from a team (or left it).
+             *     - `team.invite.created`: An invitation to join a team was created.
+             *     - `team.invite.revoked`: A pending team invitation was revoked.
+             *     - `team.invite.accepted`: A team invitation was accepted.
+             *
+             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             */
             events: string[];
             /** @enum {string} */
             channel: "webhook";
@@ -6122,11 +6283,11 @@ export interface components {
             config: {
                 /**
                  * Format: uri
-                 * @description Webhook URL
+                 * @description Webhook URL. Must be `https`. Deliveries to private, loopback, link-local or metadata addresses are refused at delivery time.
                  */
                 url: string;
-                /** @description Secret used to sign the webhook payload */
-                secret: string;
+                /** @description Secret used to sign the webhook payload. Optional: when omitted one is generated and returned once, in the `secret` field of the response. */
+                secret?: string;
             };
             /** @description Add Metadata */
             metadata?: {
@@ -6136,11 +6297,11 @@ export interface components {
         NotificationSubscriptionWebhookConfigCreate: {
             /**
              * Format: uri
-             * @description Webhook URL
+             * @description Webhook URL. Must be `https`. Deliveries to private, loopback, link-local or metadata addresses are refused at delivery time.
              */
             url: string;
-            /** @description Secret used to sign the webhook payload */
-            secret: string;
+            /** @description Secret used to sign the webhook payload. Optional: when omitted one is generated and returned once, in the `secret` field of the response. */
+            secret?: string;
         };
         /** @description Add Metadata */
         NotificationSubscriptionWebhookMetadataCreate: {
@@ -6161,6 +6322,26 @@ export interface components {
                 [key: string]: unknown;
             };
         } | {
+            /**
+             * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+             *
+             *     - `user.created`: A user was created (signup, import or Management API).
+             *     - `user.updated`: A user was updated.
+             *     - `user.deleted`: A user was deleted.
+             *     - `auth.login`: A user logged in.
+             *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+             *     - `team.created`: A team was created.
+             *     - `team.updated`: A team was updated.
+             *     - `team.deleted`: A team was deleted.
+             *     - `team.member.added`: A user was added to a team.
+             *     - `team.member.updated`: A team member's roles changed.
+             *     - `team.member.removed`: A user was removed from a team (or left it).
+             *     - `team.invite.created`: An invitation to join a team was created.
+             *     - `team.invite.revoked`: A pending team invitation was revoked.
+             *     - `team.invite.accepted`: A team invitation was accepted.
+             *
+             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             */
             events?: string[];
             /** @enum {string} */
             channel?: "webhook";
@@ -6169,10 +6350,10 @@ export interface components {
             config?: {
                 /**
                  * Format: uri
-                 * @description Webhook URL
+                 * @description Webhook URL. Must be `https`.
                  */
                 url?: string;
-                /** @description Secret used to sign the webhook payload */
+                /** @description Replaces the signing secret immediately, with no overlap. Prefer `POST /notificationsubscription/{id}/rotate-secret`, which keeps the previous secret valid for 24 hours. */
                 secret?: string;
             };
             /** @description Metadata update */
@@ -6759,13 +6940,20 @@ export interface components {
          *     - `invite_used` (400): The invite was already accepted.
          *     - `already_member` (400): The user is already a member of the team.
          *     - `not_a_member` (404): The user is not a member of the team.
+         *     - `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.
+         *     - `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.
          *     - `role_not_found` (404): No role with that id in this account.
          *     - `invalid_role` (400): The role belongs to another account.
          *     - `flow_not_found` (400): The login flow does not exist in this account.
          *     - `revision_not_found` (404): The revision is not in the flow history.
+         *     - `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.
+         *     - `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.
+         *     - `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.
+         *     - `delivery_not_found` (404): No webhook delivery with that id for this subscription.
+         *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -16964,141 +17152,6 @@ export interface operations {
             };
         };
     };
-    "rolemember/create": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
-                     * @example [
-                     *       "user_6555fd293acc2f0fac0e3452"
-                     *     ]
-                     */
-                    users: string[];
-                };
-            };
-        };
-        responses: {
-            /** @description RoleMember */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        /** @description RoleMember ID */
-                        id: string;
-                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
-                        role: components["schemas"]["Role"] | string | unknown;
-                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
-                        user: components["schemas"]["User"] | string | unknown;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description RoleMemberMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description RoleMember creation date */
-                        createdAt: string;
-                        /** @description RoleMember updated date */
-                        updatedAt?: string;
-                    };
-                };
-            };
-            /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
-                    };
-                };
-            };
-            /** @description `unauthorized` — The request carries no valid credentials. */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "unauthorized";
-                    };
-                };
-            };
-            /**
-             * @description `forbidden` — The credentials are valid but do not allow this operation.
-             *
-             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
-             *
-             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
-             */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
-                    };
-                };
-            };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "account_not_found";
-                    };
-                };
-            };
-            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
-            429: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "too_many_requests";
-                    };
-                };
-            };
-            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
-            500: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "internal_error";
-                    };
-                };
-            };
-        };
-    };
     "rolemember/get": {
         parameters: {
             query?: {
@@ -17769,27 +17822,36 @@ export interface operations {
             };
         };
     };
-    "team/update": {
+    "team/put": {
         parameters: {
             query?: never;
             header?: never;
             path: {
+                /** @description Id of the team to create or update: `team_` followed by 24 lowercase hex characters, chosen by the caller. */
                 team_id: string;
             };
             cookie?: never;
         };
-        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        /** @description Payload for creating or updating a Team under a caller-chosen id. */
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description New human-readable name for the team. */
-                    name?: string;
-                    /** @description New free-form description for the team. */
-                    description?: string;
-                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
-                    metadata?: {
-                        [key: string]: unknown;
-                    };
+                    /**
+                     * @description Human-readable name of the team.
+                     * @example Acme Engineering
+                     */
+                    name: string;
+                    /**
+                     * @description URL-safe identifier, unique within the tenant. Derived from `name` when omitted on creation; when given, it is set as-is (also on update). Pass it when names can repeat.
+                     * @example acme-engineering
+                     */
+                    slug?: string;
+                    /** @description Optional free-form description. */
+                    description?: string;
+                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
                 };
             };
         };
@@ -17833,10 +17895,47 @@ export interface operations {
                     };
                 };
             };
+            /** @description Team */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -17847,7 +17946,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "already_exists" | "validation_error";
                     };
                 };
             };
@@ -17881,11 +17980,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -17893,7 +17988,19 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `team_id_unavailable` — The team id cannot be used in this tenant. Pick another id or let the API generate one. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "team_id_unavailable";
                     };
                 };
             };
@@ -17923,7 +18030,7 @@ export interface operations {
             };
         };
     };
-    "team/delete": {
+    "team/update": {
         parameters: {
             query?: never;
             header?: never;
@@ -17932,7 +18039,21 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name for the team. */
+                    name?: string;
+                    /** @description New free-form description for the team. */
+                    description?: string;
+                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
         responses: {
             /** @description Team */
             200: {
@@ -17976,6 +18097,8 @@ export interface operations {
             /**
              * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -17985,7 +18108,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
                     };
                 };
             };
@@ -18061,48 +18184,58 @@ export interface operations {
             };
         };
     };
-    "teammember/list": {
+    "team/delete": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
-                user?: string;
-                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
-                team?: string;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
-                expand?: ("user" | "team" | "roles")[];
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                team_id: string;
+            };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Team */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["TeamMember"][];
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
                     };
                 };
             };
             /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -18113,7 +18246,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        error_code?: "invalid_id" | "validation_error";
                     };
                 };
             };
@@ -18147,7 +18280,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -18155,7 +18292,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -18185,69 +18322,48 @@ export interface operations {
             };
         };
     };
-    "teammember/create": {
+    "teammember/list": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
+                user?: string;
+                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
+                team?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
+            };
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description List of User ids to add as members of the team. Users already in the team are skipped.
-                     * @example [
-                     *       "user_6555fd293acc2f0fac0e3452"
-                     *     ]
-                     */
-                    users: string[];
-                    /**
-                     * @description Role ids to grant to the added members within the scope of this team.
-                     * @default []
-                     * @example [
-                     *       "role_6555fd293acc2f0fac0e3452"
-                     *     ]
-                     */
-                    roles?: string[];
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description TeamMember */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description TeamMember ID */
-                        id: string;
-                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
-                        user: components["schemas"]["User"] | string | unknown;
-                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
-                        team: components["schemas"]["Team"] | string | unknown;
-                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
-                        roles: (components["schemas"]["Role"] | string | unknown)[];
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description TeamMemberMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description TeamMember creation date */
-                        createdAt: string;
-                        /** @description TeamMember updated date */
-                        updatedAt?: string;
+                        next: string | null;
+                        results: components["schemas"]["TeamMember"][];
                     };
                 };
             };
             /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -18258,7 +18374,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
                     };
                 };
             };
@@ -18775,6 +18891,8 @@ export interface operations {
             /**
              * @description `already_member` — The user is already a member of the team.
              *
+             *     `invalid_role` — The role belongs to another account.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -18784,7 +18902,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_member" | "validation_error";
+                        error_code?: "already_member" | "invalid_role" | "validation_error";
                     };
                 };
             };
@@ -18994,64 +19112,67 @@ export interface operations {
             };
         };
     };
-    "team/listInvites": {
+    "team/updateMember": {
         parameters: {
-            query?: {
-                /** @description FaableQL filter. Supported fields: `email`. Example: `?query=email:foo@bar.com` */
-                query?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 team_id: string;
+                user_id: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
+        /** @description Payload for replacing the roles of one team member. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Role ids the member will hold within this team. Replaces the current list entirely; `[]` leaves the member without roles.
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description TeamMember */
+            200: {
+                headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: {
-                            /** @description TeamInvite ID */
-                            id: string;
-                            /** @description Email address that was invited */
-                            email: string;
-                            /** @description Team the invitee will be added to upon acceptance. */
-                            team: components["schemas"]["Team"] | string | unknown;
-                            /** @description User that created the invitation, if known. */
-                            inviter?: components["schemas"]["User"] | string | unknown;
-                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
-                            roles: string[];
-                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
-                            mode: "auto" | "invite";
-                            /** @description URI to redirect the invitee to after a successful accept. */
-                            redirect_uri?: string;
-                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
-                            expires_at: string;
-                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
-                            consume_date?: string;
-                            /** @description Object is related with this account */
-                            account: string;
-                            /**
-                             * @description TeamInviteMetadata
-                             * @default {}
-                             */
-                            metadata: {
-                                [key: string]: unknown;
-                            };
-                            /** @description TeamInvite creation date */
-                            createdAt: string;
-                            /** @description TeamInvite updated date */
-                            updatedAt?: string;
-                        }[];
+                        /** @description TeamMember ID */
+                        id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                        team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                        roles: (components["schemas"]["Role"] | string | unknown)[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description TeamMember creation date */
+                        createdAt: string;
+                        /** @description TeamMember updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            /**
+             * @description `invalid_role` — The role belongs to another account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19059,7 +19180,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "validation_error";
+                        error_code?: "invalid_role" | "validation_error";
                     };
                 };
             };
@@ -19093,7 +19214,13 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_a_member` — The user is not a member of the team.
+             *
+             *     `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19101,7 +19228,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_a_member" | "not_found" | "account_not_found";
                     };
                 };
             };
@@ -19131,36 +19258,17 @@ export interface operations {
             };
         };
     };
-    "team/invite": {
+    "team/removeMember": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 team_id: string;
+                user_id: string;
             };
             cookie?: never;
         };
-        /** @description Payload for inviting a user to a team by email. `mode='auto'` (default) adds the user immediately if they already exist in the tenant and falls back to a ticketed invite otherwise. `mode='invite'` always issues a ticket + email. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description Email of the user to invite to the team.
-                     * @example someone@example.com
-                     */
-                    email: string;
-                    /**
-                     * @description Role ids granted to the resulting TeamMember within the scope of this team.
-                     * @default []
-                     */
-                    roles?: string[];
-                    /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
-                    mode?: "auto" | "invite";
-                    /** @description Where to redirect the invitee after a successful accept. Defaults to `/`. */
-                    redirect_uri?: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
@@ -19169,42 +19277,14 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /** @description `invited` when a ticket + email was issued, `added` when the user was added directly (auto mode + existing user). */
-                        status: "invited" | "added";
-                        /** @description ID of the issued invite ticket (when status=invited). */
-                        ticket_id?: string;
-                        /** @description TeamMember */
-                        member?: {
-                            /** @description TeamMember ID */
-                            id: string;
-                            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
-                            user: components["schemas"]["User"] | string | unknown;
-                            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
-                            team: components["schemas"]["Team"] | string | unknown;
-                            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
-                            roles: (components["schemas"]["Role"] | string | unknown)[];
-                            /** @description Object is related with this account */
-                            account: string;
-                            /**
-                             * @description TeamMemberMetadata
-                             * @default {}
-                             */
-                            metadata: {
-                                [key: string]: unknown;
-                            };
-                            /** @description TeamMember creation date */
-                            createdAt: string;
-                            /** @description TeamMember updated date */
-                            updatedAt?: string;
-                        };
+                        /** @description Id of the removed TeamMember record. */
+                        id: string;
+                        /** @enum {boolean} */
+                        deleted: true;
                     };
                 };
             };
-            /**
-             * @description `invite_used` — The invite was already accepted.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19212,7 +19292,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invite_used" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -19246,7 +19326,13 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_a_member` — The user is not a member of the team.
+             *
+             *     `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19254,7 +19340,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_a_member" | "not_found" | "account_not_found";
                     };
                 };
             };
@@ -19284,13 +19370,15 @@ export interface operations {
             };
         };
     };
-    "team/revokeInvite": {
+    "team/listInvites": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description FaableQL filter. Supported fields: `email`. Example: `?query=email:foo@bar.com` */
+                query?: string;
+            };
             header?: never;
             path: {
                 team_id: string;
-                ticket_id: string;
             };
             cookie?: never;
         };
@@ -19303,8 +19391,39 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /** @enum {string} */
-                        status: "revoked";
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Team the invitee will be added to upon acceptance. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description User that created the invitation, if known. */
+                            inviter?: components["schemas"]["User"] | string | unknown;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
                     };
                 };
             };
@@ -19350,11 +19469,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `invite_not_found` — No invite with that id in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19362,7 +19477,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invite_not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -19392,118 +19507,36 @@ export interface operations {
             };
         };
     };
-    team_invite_verify: {
+    "team/invite": {
         parameters: {
-            query?: {
-                token?: string;
-                ticket?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                team_id: string;
+            };
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /**
-             * @description `invalid_ticket` — The ticket does not exist or is not the kind this endpoint accepts.
-             *
-             *     `ticket_expired` — The ticket is past its expiry.
-             *
-             *     `ticket_used` — The ticket was already consumed.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "invalid_ticket" | "ticket_expired" | "ticket_used" | "validation_error";
-                    };
-                };
-            };
-            /**
-             * @description `invite_not_found` — No invite with that id in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "invite_not_found" | "account_not_found";
-                    };
-                };
-            };
-            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
-            429: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "too_many_requests";
-                    };
-                };
-            };
-            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
-            500: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "internal_error";
-                    };
-                };
-            };
-        };
-    };
-    "api/list": {
-        parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Exact match on `name`. Equivalent to `?query=name:<value>`. */
-                name?: string;
-                /** @description Exact match on `slug`. Equivalent to `?query=slug:<value>`. */
-                slug?: string;
-                /** @description Exact match on `identifier`. Equivalent to `?query=identifier:<value>`. */
-                identifier?: string;
-                /** @description Exact match on `token_dialect`. Equivalent to `?query=token_dialect:<value>`. */
-                token_dialect?: string;
-                /** @description Exact match on `enforce_policies`. Equivalent to `?query=enforce_policies:<value>`. */
-                enforce_policies?: string;
-                /** @description Exact match on `allow_offline_access`. Equivalent to `?query=allow_offline_access:<value>`. */
-                allow_offline_access?: string;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
-                q?: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
+        /** @description Payload for inviting a user to a team by email. `mode='auto'` (default) adds the user immediately if they already exist in the tenant and falls back to a ticketed invite otherwise. `mode='invite'` always issues a ticket + email. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Email of the user to invite to the team.
+                     * @example someone@example.com
+                     */
+                    email: string;
+                    /**
+                     * @description Role ids granted to the resulting TeamMember within the scope of this team.
+                     * @default []
+                     */
+                    roles?: string[];
+                    /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                    mode?: "auto" | "invite";
+                    /** @description Where to redirect the invitee after a successful accept. Defaults to `/`. */
+                    redirect_uri?: string;
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
             200: {
@@ -19512,17 +19545,41 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["Api"][];
+                        /** @description `invited` when a ticket + email was issued, `added` when the user was added directly (auto mode + existing user). */
+                        status: "invited" | "added";
+                        /** @description ID of the issued invite ticket (when status=invited). */
+                        ticket_id?: string;
+                        /** @description TeamMember */
+                        member?: {
+                            /** @description TeamMember ID */
+                            id: string;
+                            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                            user: components["schemas"]["User"] | string | unknown;
+                            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                            roles: (components["schemas"]["Role"] | string | unknown)[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamMemberMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamMember creation date */
+                            createdAt: string;
+                            /** @description TeamMember updated date */
+                            updatedAt?: string;
+                        };
                     };
                 };
             };
             /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             * @description `invite_used` — The invite was already accepted.
              *
-             *     `search_not_supported` — This resource does not support `?search=`.
+             *     `invalid_role` — The role belongs to another account.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -19533,7 +19590,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        error_code?: "invite_used" | "invalid_role" | "validation_error";
                     };
                 };
             };
@@ -19605,124 +19662,31 @@ export interface operations {
             };
         };
     };
-    "api/create": {
+    "team/revokeInvite": {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description Human-readable name for the API.
-                     * @example My Backend API
-                     */
-                    name: string;
-                    /**
-                     * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
-                     * @example https://api.faable.com
-                     */
-                    identifier: string;
-                    /** @description Optional human-readable description of the API. */
-                    description?: string;
-                    /**
-                     * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
-                     * @default []
-                     */
-                    permissions?: components["schemas"]["PermissionCreate"][];
-                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
-                    signing_alg?: "RS256";
-                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
-                    token_dialect?: "access_token" | "access_token_authz";
-                    /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
-                    token_lifetime?: number;
-                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
-                    enforce_policies?: boolean;
-                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
-                    allow_offline_access?: boolean;
-                    /** @description When true, skip the consent prompt for first-party clients. */
-                    skip_consent?: boolean;
-                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
-                    include_teams_in_access_token?: boolean;
-                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
-                    include_roles_in_access_token?: boolean;
-                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
-                    include_teams_in_id_token?: boolean;
-                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
-                    include_roles_in_id_token?: boolean;
-                };
+            path: {
+                team_id: string;
+                ticket_id: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description Api */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Api ID */
-                        id: string;
-                        /**
-                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
-                         * @example My Backend API
-                         */
-                        name: string;
-                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
-                        slug: string;
-                        /**
-                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
-                         * @example https://api.faable.com
-                         */
-                        identifier: string;
-                        /** @description Optional human-readable description of the API. */
-                        description?: string;
-                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
-                        permissions: components["schemas"]["Permission"][];
-                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
-                        signing_alg: "RS256";
-                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
-                        token_dialect: "access_token" | "access_token_authz";
-                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
-                        token_lifetime: number;
-                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
-                        enforce_policies: boolean;
-                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
-                        allow_offline_access: boolean;
-                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
-                        skip_consent: boolean;
-                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
-                        include_teams_in_access_token: boolean;
-                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
-                        include_roles_in_access_token: boolean;
-                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
-                        include_teams_in_id_token: boolean;
-                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
-                        include_roles_in_id_token: boolean;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description ApiMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Api creation date */
-                        createdAt: string;
-                        /** @description Api updated date */
-                        updatedAt?: string;
+                        /** @enum {string} */
+                        status: "revoked";
                     };
                 };
             };
-            /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19730,7 +19694,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -19764,7 +19728,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `invite_not_found` — No invite with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19772,7 +19740,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "invite_not_found" | "account_not_found";
                     };
                 };
             };
@@ -19802,83 +19770,138 @@ export interface operations {
             };
         };
     };
-    "api/get": {
+    team_invite_verify: {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                api_id: string;
+            query?: {
+                token?: string;
+                ticket?: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Api */
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_ticket` — The ticket does not exist or is not the kind this endpoint accepts.
+             *
+             *     `ticket_expired` — The ticket is past its expiry.
+             *
+             *     `ticket_used` — The ticket was already consumed.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_ticket" | "ticket_expired" | "ticket_used" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `invite_not_found` — No invite with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invite_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "api/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Exact match on `name`. Equivalent to `?query=name:<value>`. */
+                name?: string;
+                /** @description Exact match on `slug`. Equivalent to `?query=slug:<value>`. */
+                slug?: string;
+                /** @description Exact match on `identifier`. Equivalent to `?query=identifier:<value>`. */
+                identifier?: string;
+                /** @description Exact match on `token_dialect`. Equivalent to `?query=token_dialect:<value>`. */
+                token_dialect?: string;
+                /** @description Exact match on `enforce_policies`. Equivalent to `?query=enforce_policies:<value>`. */
+                enforce_policies?: string;
+                /** @description Exact match on `allow_offline_access`. Equivalent to `?query=allow_offline_access:<value>`. */
+                allow_offline_access?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Api ID */
-                        id: string;
-                        /**
-                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
-                         * @example My Backend API
-                         */
-                        name: string;
-                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
-                        slug: string;
-                        /**
-                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
-                         * @example https://api.faable.com
-                         */
-                        identifier: string;
-                        /** @description Optional human-readable description of the API. */
-                        description?: string;
-                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
-                        permissions: components["schemas"]["Permission"][];
-                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
-                        signing_alg: "RS256";
-                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
-                        token_dialect: "access_token" | "access_token_authz";
-                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
-                        token_lifetime: number;
-                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
-                        enforce_policies: boolean;
-                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
-                        allow_offline_access: boolean;
-                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
-                        skip_consent: boolean;
-                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
-                        include_teams_in_access_token: boolean;
-                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
-                        include_roles_in_access_token: boolean;
-                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
-                        include_teams_in_id_token: boolean;
-                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
-                        include_roles_in_id_token: boolean;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description ApiMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Api creation date */
-                        createdAt: string;
-                        /** @description Api updated date */
-                        updatedAt?: string;
+                        next: string | null;
+                        results: components["schemas"]["Api"][];
                     };
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
              *
              *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
              *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -19888,7 +19911,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
                     };
                 };
             };
@@ -19922,11 +19945,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19934,7 +19953,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -19964,30 +19983,39 @@ export interface operations {
             };
         };
     };
-    "api/update": {
+    "api/create": {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                api_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Human-readable name for the API. */
-                    name?: string;
+                    /**
+                     * @description Human-readable name for the API.
+                     * @example My Backend API
+                     */
+                    name: string;
+                    /**
+                     * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
+                     * @example https://api.faable.com
+                     */
+                    identifier: string;
                     /** @description Optional human-readable description of the API. */
                     description?: string;
-                    /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+                    /**
+                     * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
+                     * @default []
+                     */
                     permissions?: components["schemas"]["PermissionCreate"][];
                     /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
                     signing_alg?: "RS256";
                     /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
                     token_dialect?: "access_token" | "access_token_authz";
-                    /** @description Access_token lifetime in seconds. */
+                    /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
                     token_lifetime?: number;
                     /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
                     enforce_policies?: boolean;
@@ -20069,9 +20097,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -20082,7 +20108,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "already_exists" | "validation_error";
                     };
                 };
             };
@@ -20116,11 +20142,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -20128,7 +20150,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -20158,7 +20180,7 @@ export interface operations {
             };
         };
     };
-    "api/delete": {
+    "api/get": {
         parameters: {
             query?: never;
             header?: never;
@@ -20233,6 +20255,8 @@ export interface operations {
             /**
              * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -20242,7 +20266,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
                     };
                 };
             };
@@ -20318,28 +20342,125 @@ export interface operations {
             };
         };
     };
-    "account/getKeys": {
+    "api/update": {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                api_id: string;
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Human-readable name for the API. */
+                    name?: string;
+                    /** @description Optional human-readable description of the API. */
+                    description?: string;
+                    /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+                    permissions?: components["schemas"]["PermissionCreate"][];
+                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                    signing_alg?: "RS256";
+                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                    token_dialect?: "access_token" | "access_token_authz";
+                    /** @description Access_token lifetime in seconds. */
+                    token_lifetime?: number;
+                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+                    enforce_policies?: boolean;
+                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+                    allow_offline_access?: boolean;
+                    /** @description When true, skip the consent prompt for first-party clients. */
+                    skip_consent?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_access_token?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_access_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_id_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_id_token?: boolean;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description Api */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description kid currently used to sign new tokens */
-                        production_kid: string;
-                        /** @description kid that will be promoted on the next rotation */
-                        next_in_queue_kid: string;
-                        /** @description All kids currently published in the JWK Set */
-                        kids_active: string[];
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
                     };
                 };
             };
@@ -20373,7 +20494,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -20381,7 +20506,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -20411,40 +20536,83 @@ export interface operations {
             };
         };
     };
-    "account/rotateKeys": {
+    "api/delete": {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": Record<string, never>;
+            path: {
+                api_id: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Api */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description ISO 8601 timestamp of the rotation */
-                        rotated_at: string;
-                        /** @description kid that was active before rotation. Tokens signed with it are still verifiable via /.well-known/jwks.json */
-                        previous_production_kid: string;
-                        /** @description kid now used to sign new tokens */
-                        production_kid: string;
-                        /** @description kid that will be promoted on the next rotation */
-                        next_in_queue_kid: string;
-                        /** @description All kids currently published in the JWK Set */
-                        kids_active: string[];
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -20452,7 +20620,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "validation_error";
+                        error_code?: "invalid_id" | "validation_error";
                     };
                 };
             };
@@ -20486,7 +20654,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -20494,7 +20666,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -20524,18 +20696,9 @@ export interface operations {
             };
         };
     };
-    "action/list": {
+    "account/getKeys": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
@@ -20549,28 +20712,12 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["Action"][];
-                    };
-                };
-            };
-            /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        /** @description kid currently used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
                     };
                 };
             };
@@ -20642,7 +20789,7 @@ export interface operations {
             };
         };
     };
-    "action/create": {
+    "account/rotateKeys": {
         parameters: {
             query?: never;
             header?: never;
@@ -20651,73 +20798,146 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    /** @description Action Name */
-                    name: string;
-                    /** @description JavaScript code. Must export at least one hook: exports.onExecutePostLogin, exports.onExecuteContinue and/or exports.onExecuteClientCredentials. The triggers are derived from the exported hooks. */
-                    code: string;
-                    /**
-                     * @description Is this action active?
-                     * @default true
-                     */
-                    enabled?: boolean;
-                    /**
-                     * @description Execution order: lower runs first; on ties the newest action runs first
-                     * @default 0
-                     */
-                    order?: number;
-                };
+                "application/json": Record<string, never>;
             };
         };
         responses: {
-            /** @description Action */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Action ID */
-                        id: string;
-                        /** @description Action Name */
-                        name: string;
-                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
-                        triggers: ("continue" | "post-login" | "client-credentials")[];
-                        /** @description JavaScript Code to execute */
-                        code: string;
-                        /**
-                         * @description Is this action active?
-                         * @default true
-                         */
-                        enabled: boolean;
-                        /**
-                         * @description Execution order: lower runs first; on ties the newest action runs first
-                         * @default 0
-                         */
-                        order: number;
-                        /**
-                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
-                         * @default 1
-                         */
-                        revision: number;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description ActionMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Action creation date */
-                        createdAt: string;
-                        /** @description Action updated date */
-                        updatedAt?: string;
+                        /** @description ISO 8601 timestamp of the rotation */
+                        rotated_at: string;
+                        /** @description kid that was active before rotation. Tokens signed with it are still verifiable via /.well-known/jwks.json */
+                        previous_production_kid: string;
+                        /** @description kid now used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
                     };
                 };
             };
             /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "action/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["Action"][];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -20728,7 +20948,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
                     };
                 };
             };
@@ -20800,16 +21020,33 @@ export interface operations {
             };
         };
     };
-    "action/get": {
+    "action/create": {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                action_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Action Name */
+                    name: string;
+                    /** @description JavaScript code. Must export at least one hook: exports.onExecutePostLogin, exports.onExecuteContinue and/or exports.onExecuteClientCredentials. The triggers are derived from the exported hooks. */
+                    code: string;
+                    /**
+                     * @description Is this action active?
+                     * @default true
+                     */
+                    enabled?: boolean;
+                    /**
+                     * @description Execution order: lower runs first; on ties the newest action runs first
+                     * @default 0
+                     */
+                    order?: number;
+                };
+            };
+        };
         responses: {
             /** @description Action */
             200: {
@@ -20858,9 +21095,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -20871,7 +21106,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                        error_code?: "already_exists" | "validation_error";
                     };
                 };
             };
@@ -20905,11 +21140,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -20917,7 +21148,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -20947,7 +21178,7 @@ export interface operations {
             };
         };
     };
-    "action/update": {
+    "action/get": {
         parameters: {
             query?: never;
             header?: never;
@@ -20956,21 +21187,7 @@ export interface operations {
             };
             cookie?: never;
         };
-        /** @description Partial update for an Action. Only the supplied fields are modified; `triggers` is read-only and follows `code`. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Action Name */
-                    name?: string;
-                    /** @description JavaScript code. The triggers are re-derived from the hooks it exports. */
-                    code?: string;
-                    /** @description Is this action active? */
-                    enabled?: boolean;
-                    /** @description Execution order */
-                    order?: number;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Action */
             200: {
@@ -21021,7 +21238,7 @@ export interface operations {
             /**
              * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -21032,7 +21249,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
                     };
                 };
             };
@@ -21108,7 +21325,7 @@ export interface operations {
             };
         };
     };
-    "action/delete": {
+    "action/update": {
         parameters: {
             query?: never;
             header?: never;
@@ -21117,7 +21334,21 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Partial update for an Action. Only the supplied fields are modified; `triggers` is read-only and follows `code`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Action Name */
+                    name?: string;
+                    /** @description JavaScript code. The triggers are re-derived from the hooks it exports. */
+                    code?: string;
+                    /** @description Is this action active? */
+                    enabled?: boolean;
+                    /** @description Execution order */
+                    order?: number;
+                };
+            };
+        };
         responses: {
             /** @description Action */
             200: {
@@ -21168,6 +21399,8 @@ export interface operations {
             /**
              * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -21177,7 +21410,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
                     };
                 };
             };
@@ -21253,38 +21486,183 @@ export interface operations {
             };
         };
     };
-    "loginflow/resolved": {
+    "action/delete": {
         parameters: {
-            query?: {
-                client_id?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                action_id: string;
+            };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Action */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        source: "compiled" | "published";
-                        flow_id: string | null;
-                        revision: number;
-                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                        graph: {
-                            nodes: {
-                                id: string;
-                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                config?: {
-                                    [key: string]: unknown;
-                                };
-                            }[];
-                            edges: {
-                                from: string;
+                        /** @description Action ID */
+                        id: string;
+                        /** @description Action Name */
+                        name: string;
+                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
+                        triggers: ("continue" | "post-login" | "client-credentials")[];
+                        /** @description JavaScript Code to execute */
+                        code: string;
+                        /**
+                         * @description Is this action active?
+                         * @default true
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Execution order: lower runs first; on ties the newest action runs first
+                         * @default 0
+                         */
+                        order: number;
+                        /**
+                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
+                         * @default 1
+                         */
+                        revision: number;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ActionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Action creation date */
+                        createdAt: string;
+                        /** @description Action updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/resolved": {
+        parameters: {
+            query?: {
+                client_id?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        source: "compiled" | "published";
+                        flow_id: string | null;
+                        revision: number;
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
                                 handle: string;
                                 to: string;
                             }[];
@@ -23287,6 +23665,26 @@ export interface operations {
                         [key: string]: unknown;
                     };
                 } | {
+                    /**
+                     * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                     *
+                     *     - `user.created`: A user was created (signup, import or Management API).
+                     *     - `user.updated`: A user was updated.
+                     *     - `user.deleted`: A user was deleted.
+                     *     - `auth.login`: A user logged in.
+                     *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                     *     - `team.created`: A team was created.
+                     *     - `team.updated`: A team was updated.
+                     *     - `team.deleted`: A team was deleted.
+                     *     - `team.member.added`: A user was added to a team.
+                     *     - `team.member.updated`: A team member's roles changed.
+                     *     - `team.member.removed`: A user was removed from a team (or left it).
+                     *     - `team.invite.created`: An invitation to join a team was created.
+                     *     - `team.invite.revoked`: A pending team invitation was revoked.
+                     *     - `team.invite.accepted`: A team invitation was accepted.
+                     *
+                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     */
                     events: string[];
                     /** @enum {string} */
                     channel: "webhook";
@@ -23295,11 +23693,11 @@ export interface operations {
                     config: {
                         /**
                          * Format: uri
-                         * @description Webhook URL
+                         * @description Webhook URL. Must be `https`. Deliveries to private, loopback, link-local or metadata addresses are refused at delivery time.
                          */
                         url: string;
-                        /** @description Secret used to sign the webhook payload */
-                        secret: string;
+                        /** @description Secret used to sign the webhook payload. Optional: when omitted one is generated and returned once, in the `secret` field of the response. */
+                        secret?: string;
                     };
                     /** @description Add Metadata */
                     metadata?: {
@@ -23342,6 +23740,668 @@ export interface operations {
                     } | {
                         /** @description NotificationSubscriptionWebhook ID */
                         id: string;
+                        /**
+                         * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                         *
+                         *     - `user.created`: A user was created (signup, import or Management API).
+                         *     - `user.updated`: A user was updated.
+                         *     - `user.deleted`: A user was deleted.
+                         *     - `auth.login`: A user logged in.
+                         *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                         *     - `team.created`: A team was created.
+                         *     - `team.updated`: A team was updated.
+                         *     - `team.deleted`: A team was deleted.
+                         *     - `team.member.added`: A user was added to a team.
+                         *     - `team.member.updated`: A team member's roles changed.
+                         *     - `team.member.removed`: A user was removed from a team (or left it).
+                         *     - `team.invite.created`: An invitation to join a team was created.
+                         *     - `team.invite.revoked`: A pending team invitation was revoked.
+                         *     - `team.invite.accepted`: A team invitation was accepted.
+                         *
+                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         */
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "webhook";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            /**
+                             * Format: uri
+                             * @description Webhook URL
+                             */
+                            url: string;
+                            /**
+                             * Format: date-time
+                             * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                             */
+                            previous_secret_expires_at?: string;
+                        };
+                        /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+                        status?: "healthy" | "failing";
+                        /** @description Failed delivery attempts since the last success. */
+                        consecutive_failures?: number;
+                        /** Format: date-time */
+                        last_failure_at?: string;
+                        /** Format: date-time */
+                        last_success_at?: string;
+                        /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+                        secret?: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionWebhookMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionWebhook creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionWebhook updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "notificationsubscription/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                notificationsubscription_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description NotificationSubscription */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description NotificationSubscriptionEmail ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "email";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            recipients: string[];
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionEmailMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionEmail creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionEmail updated date */
+                        updatedAt?: string;
+                    } | {
+                        /** @description NotificationSubscriptionWebhook ID */
+                        id: string;
+                        /**
+                         * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                         *
+                         *     - `user.created`: A user was created (signup, import or Management API).
+                         *     - `user.updated`: A user was updated.
+                         *     - `user.deleted`: A user was deleted.
+                         *     - `auth.login`: A user logged in.
+                         *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                         *     - `team.created`: A team was created.
+                         *     - `team.updated`: A team was updated.
+                         *     - `team.deleted`: A team was deleted.
+                         *     - `team.member.added`: A user was added to a team.
+                         *     - `team.member.updated`: A team member's roles changed.
+                         *     - `team.member.removed`: A user was removed from a team (or left it).
+                         *     - `team.invite.created`: An invitation to join a team was created.
+                         *     - `team.invite.revoked`: A pending team invitation was revoked.
+                         *     - `team.invite.accepted`: A team invitation was accepted.
+                         *
+                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         */
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "webhook";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            /**
+                             * Format: uri
+                             * @description Webhook URL
+                             */
+                            url: string;
+                            /**
+                             * Format: date-time
+                             * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                             */
+                            previous_secret_expires_at?: string;
+                        };
+                        /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+                        status?: "healthy" | "failing";
+                        /** @description Failed delivery attempts since the last success. */
+                        consecutive_failures?: number;
+                        /** Format: date-time */
+                        last_failure_at?: string;
+                        /** Format: date-time */
+                        last_success_at?: string;
+                        /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+                        secret?: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionWebhookMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionWebhook creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionWebhook updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "notificationsubscription/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                notificationsubscription_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description NotificationSubscriptionUpdate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    events?: string[];
+                    /** @enum {string} */
+                    channel?: "email";
+                    /** @description Whether the subscription is active */
+                    active?: boolean;
+                    config?: {
+                        recipients?: string[];
+                    };
+                    /** @description Metadata update */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                } | {
+                    /**
+                     * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                     *
+                     *     - `user.created`: A user was created (signup, import or Management API).
+                     *     - `user.updated`: A user was updated.
+                     *     - `user.deleted`: A user was deleted.
+                     *     - `auth.login`: A user logged in.
+                     *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                     *     - `team.created`: A team was created.
+                     *     - `team.updated`: A team was updated.
+                     *     - `team.deleted`: A team was deleted.
+                     *     - `team.member.added`: A user was added to a team.
+                     *     - `team.member.updated`: A team member's roles changed.
+                     *     - `team.member.removed`: A user was removed from a team (or left it).
+                     *     - `team.invite.created`: An invitation to join a team was created.
+                     *     - `team.invite.revoked`: A pending team invitation was revoked.
+                     *     - `team.invite.accepted`: A team invitation was accepted.
+                     *
+                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     */
+                    events?: string[];
+                    /** @enum {string} */
+                    channel?: "webhook";
+                    /** @description Whether the subscription is active */
+                    active?: boolean;
+                    config?: {
+                        /**
+                         * Format: uri
+                         * @description Webhook URL. Must be `https`.
+                         */
+                        url?: string;
+                        /** @description Replaces the signing secret immediately, with no overlap. Prefer `POST /notificationsubscription/{id}/rotate-secret`, which keeps the previous secret valid for 24 hours. */
+                        secret?: string;
+                    };
+                    /** @description Metadata update */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description NotificationSubscription */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description NotificationSubscriptionEmail ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "email";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            recipients: string[];
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionEmailMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionEmail creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionEmail updated date */
+                        updatedAt?: string;
+                    } | {
+                        /** @description NotificationSubscriptionWebhook ID */
+                        id: string;
+                        /**
+                         * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                         *
+                         *     - `user.created`: A user was created (signup, import or Management API).
+                         *     - `user.updated`: A user was updated.
+                         *     - `user.deleted`: A user was deleted.
+                         *     - `auth.login`: A user logged in.
+                         *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                         *     - `team.created`: A team was created.
+                         *     - `team.updated`: A team was updated.
+                         *     - `team.deleted`: A team was deleted.
+                         *     - `team.member.added`: A user was added to a team.
+                         *     - `team.member.updated`: A team member's roles changed.
+                         *     - `team.member.removed`: A user was removed from a team (or left it).
+                         *     - `team.invite.created`: An invitation to join a team was created.
+                         *     - `team.invite.revoked`: A pending team invitation was revoked.
+                         *     - `team.invite.accepted`: A team invitation was accepted.
+                         *
+                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         */
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "webhook";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            /**
+                             * Format: uri
+                             * @description Webhook URL
+                             */
+                            url: string;
+                            /**
+                             * Format: date-time
+                             * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                             */
+                            previous_secret_expires_at?: string;
+                        };
+                        /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+                        status?: "healthy" | "failing";
+                        /** @description Failed delivery attempts since the last success. */
+                        consecutive_failures?: number;
+                        /** Format: date-time */
+                        last_failure_at?: string;
+                        /** Format: date-time */
+                        last_success_at?: string;
+                        /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+                        secret?: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionWebhookMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionWebhook creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionWebhook updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "notificationsubscription/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                notificationsubscription_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description NotificationSubscription */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description NotificationSubscriptionEmail ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "email";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            recipients: string[];
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionEmailMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionEmail creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionEmail updated date */
+                        updatedAt?: string;
+                    } | {
+                        /** @description NotificationSubscriptionWebhook ID */
+                        id: string;
+                        /**
+                         * @description Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:
+                         *
+                         *     - `user.created`: A user was created (signup, import or Management API).
+                         *     - `user.updated`: A user was updated.
+                         *     - `user.deleted`: A user was deleted.
+                         *     - `auth.login`: A user logged in.
+                         *     - `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).
+                         *     - `team.created`: A team was created.
+                         *     - `team.updated`: A team was updated.
+                         *     - `team.deleted`: A team was deleted.
+                         *     - `team.member.added`: A user was added to a team.
+                         *     - `team.member.updated`: A team member's roles changed.
+                         *     - `team.member.removed`: A user was removed from a team (or left it).
+                         *     - `team.invite.created`: An invitation to join a team was created.
+                         *     - `team.invite.revoked`: A pending team invitation was revoked.
+                         *     - `team.invite.accepted`: A team invitation was accepted.
+                         *
+                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         */
                         events: string[];
                         /** @enum {string} */
                         channel: "webhook";
@@ -23353,9 +24413,22 @@ export interface operations {
                              * @description Webhook URL
                              */
                             url: string;
-                            /** @description Secret used to sign the webhook payload */
-                            secret: string;
+                            /**
+                             * Format: date-time
+                             * @description Set after a `rotate-secret`: until this instant deliveries are signed with both the new and the previous secret.
+                             */
+                            previous_secret_expires_at?: string;
                         };
+                        /** @description `failing` after several consecutive failed delivery attempts; the next successful delivery (or a successful `test`) sets it back to `healthy`. A failing subscription keeps receiving deliveries: it is never deactivated automatically. */
+                        status?: "healthy" | "failing";
+                        /** @description Failed delivery attempts since the last success. */
+                        consecutive_failures?: number;
+                        /** Format: date-time */
+                        last_failure_at?: string;
+                        /** Format: date-time */
+                        last_success_at?: string;
+                        /** @description The signing secret. Returned ONLY in the response of create (and of `rotate-secret`); get and list never include it. Store it when you create the subscription. */
+                        secret?: string;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -23373,7 +24446,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -23384,7 +24457,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "invalid_id" | "validation_error";
                     };
                 };
             };
@@ -23418,7 +24491,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -23426,7 +24503,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -23456,7 +24533,7 @@ export interface operations {
             };
         };
     };
-    "notificationsubscription/get": {
+    "notificationsubscription/test": {
         parameters: {
             query?: never;
             header?: never;
@@ -23467,73 +24544,27 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description NotificationSubscription */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description NotificationSubscriptionEmail ID */
-                        id: string;
-                        events: string[];
-                        /** @enum {string} */
-                        channel: "email";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            recipients: string[];
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description NotificationSubscriptionEmailMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionEmail creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionEmail updated date */
-                        updatedAt?: string;
-                    } | {
-                        /** @description NotificationSubscriptionWebhook ID */
-                        id: string;
-                        events: string[];
-                        /** @enum {string} */
-                        channel: "webhook";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            /**
-                             * Format: uri
-                             * @description Webhook URL
-                             */
-                            url: string;
-                            /** @description Secret used to sign the webhook payload */
-                            secret: string;
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description NotificationSubscriptionWebhookMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionWebhook creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionWebhook updated date */
-                        updatedAt?: string;
+                        /** @description Whether the endpoint answered 2xx. */
+                        ok: boolean;
+                        /** @description Id of the `ping` event (also sent as `x-faable-delivery`). */
+                        event_id: string;
+                        /** @description HTTP status the endpoint answered. */
+                        status?: number;
+                        duration_ms: number;
+                        /** @description Why it failed: `HTTP <status>`, a timeout, a network error, or a refused destination. */
+                        error?: string;
                     };
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             * @description `not_a_webhook` — The operation only applies to `webhook` subscriptions.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -23544,7 +24575,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                        error_code?: "not_a_webhook" | "validation_error";
                     };
                 };
             };
@@ -23620,7 +24651,7 @@ export interface operations {
             };
         };
     };
-    "notificationsubscription/update": {
+    "notificationsubscription/rotateSecret": {
         parameters: {
             query?: never;
             header?: never;
@@ -23629,112 +24660,35 @@ export interface operations {
             };
             cookie?: never;
         };
-        /** @description NotificationSubscriptionUpdate */
         requestBody: {
             content: {
                 "application/json": {
-                    events?: string[];
-                    /** @enum {string} */
-                    channel?: "email";
-                    /** @description Whether the subscription is active */
-                    active?: boolean;
-                    config?: {
-                        recipients?: string[];
-                    };
-                    /** @description Metadata update */
-                    metadata?: {
-                        [key: string]: unknown;
-                    };
-                } | {
-                    events?: string[];
-                    /** @enum {string} */
-                    channel?: "webhook";
-                    /** @description Whether the subscription is active */
-                    active?: boolean;
-                    config?: {
-                        /**
-                         * Format: uri
-                         * @description Webhook URL
-                         */
-                        url?: string;
-                        /** @description Secret used to sign the webhook payload */
-                        secret?: string;
-                    };
-                    /** @description Metadata update */
-                    metadata?: {
-                        [key: string]: unknown;
-                    };
+                    /** @description The new secret. Omit it (send `{}`) to have one generated. */
+                    secret?: string;
                 };
             };
         };
         responses: {
-            /** @description NotificationSubscription */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description NotificationSubscriptionEmail ID */
-                        id: string;
-                        events: string[];
-                        /** @enum {string} */
-                        channel: "email";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            recipients: string[];
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description NotificationSubscriptionEmailMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionEmail creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionEmail updated date */
-                        updatedAt?: string;
-                    } | {
-                        /** @description NotificationSubscriptionWebhook ID */
                         id: string;
-                        events: string[];
-                        /** @enum {string} */
-                        channel: "webhook";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            /**
-                             * Format: uri
-                             * @description Webhook URL
-                             */
-                            url: string;
-                            /** @description Secret used to sign the webhook payload */
-                            secret: string;
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
+                        /** @description The new signing secret. This is the only time it is returned. */
+                        secret: string;
                         /**
-                         * @description NotificationSubscriptionWebhookMetadata
-                         * @default {}
+                         * Format: date-time
+                         * @description Until this instant deliveries carry two signatures, one per secret.
                          */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionWebhook creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionWebhook updated date */
-                        updatedAt?: string;
+                        previous_secret_expires_at: string;
                     };
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `not_a_webhook` — The operation only applies to `webhook` subscriptions.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -23745,7 +24699,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "not_a_webhook" | "validation_error";
                     };
                 };
             };
@@ -23821,82 +24775,36 @@ export interface operations {
             };
         };
     };
-    "notificationsubscription/delete": {
+    "notificationsubscription/redeliver": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 notificationsubscription_id: string;
+                /** @description The delivery id: `data.delivery_id` of the `webhook.<event>` rows of the Log. */
+                delivery_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description NotificationSubscription */
-            200: {
+            /** @description Default Response */
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description NotificationSubscriptionEmail ID */
-                        id: string;
-                        events: string[];
-                        /** @enum {string} */
-                        channel: "email";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            recipients: string[];
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description NotificationSubscriptionEmailMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionEmail creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionEmail updated date */
-                        updatedAt?: string;
-                    } | {
-                        /** @description NotificationSubscriptionWebhook ID */
-                        id: string;
-                        events: string[];
+                        delivery_id: string;
                         /** @enum {string} */
-                        channel: "webhook";
-                        /** @description Whether the subscription is active */
-                        active: boolean;
-                        config: {
-                            /**
-                             * Format: uri
-                             * @description Webhook URL
-                             */
-                            url: string;
-                            /** @description Secret used to sign the webhook payload */
-                            secret: string;
-                        };
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description NotificationSubscriptionWebhookMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description NotificationSubscriptionWebhook creation date */
-                        createdAt: string;
-                        /** @description NotificationSubscriptionWebhook updated date */
-                        updatedAt?: string;
+                        status: "pending";
+                        /** Format: date-time */
+                        next_attempt_at: string;
                     };
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             * @description `not_a_webhook` — The operation only applies to `webhook` subscriptions.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -23907,7 +24815,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "not_a_webhook" | "validation_error";
                     };
                 };
             };
@@ -23944,6 +24852,8 @@ export interface operations {
             /**
              * @description `not_found` — The resource does not exist in this account.
              *
+             *     `delivery_not_found` — No webhook delivery with that id for this subscription.
+             *
              *     `account_not_found` — No Auth Account matches the request (domain, header or token).
              */
             404: {
@@ -23953,7 +24863,19 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "not_found" | "delivery_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `delivery_in_progress` — The delivery is being attempted right now; retry the redeliver in a minute. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "delivery_in_progress";
                     };
                 };
             };