@faable/auth-sdk 2.7.80 → 2.7.82

package/dist/api/types.d.ts

@@ -1196,6 +1196,118 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/organization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Put a Team in an Organization, or take it out
+         * @description Sets the Organization the Team belongs to (`null` = none). A team is in at most one organization; setting another one moves it. Belonging to an organization grants nobody access to the team. Emits `team.updated`.
+         */
+        put: operations["team/setOrganization"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List Organizations
+         * @description List Organizations
+         */
+        get: operations["organization/list"];
+        put?: never;
+        /**
+         * Create Organization
+         * @description Create Organization
+         */
+        post: operations["organization/create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Organization
+         * @description Get Organization
+         */
+        get: operations["organization/get"];
+        put?: never;
+        /**
+         * Update Organization
+         * @description Update Organization
+         */
+        post: operations["organization/update"];
+        /**
+         * Delete Organization
+         * @description Delete Organization
+         */
+        delete: operations["organization/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/admin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add an admin to an Organization
+         * @description Makes a user of this tenant an admin of the Organization. Idempotent. Being an admin does not grant access to any team of the organization. Emits `organization.updated`.
+         */
+        post: operations["organization/addAdmin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/admin/{user_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an admin from an Organization
+         * @description Removes the user from the admins of the Organization (the user is not deleted). An organization keeps at least one admin: removing the last one is `last_organization_admin`. Emits `organization.updated`.
+         */
+        delete: operations["organization/removeAdmin"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/teammember": {
         parameters: {
             query?: never;
@@ -4437,7 +4549,7 @@ export interface paths {
         put?: never;
         /**
          * OpenID Connect Dynamic Client Registration
-         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context.
+         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context. Only when the tenant has `dynamic_client_registration_enabled`; otherwise `registration_disabled` (403).
          */
         post: operations["oauth/register"];
         delete?: never;
@@ -4725,6 +4837,8 @@ export interface components {
             webauthn_rp_id?: string | null;
             /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
             logout_confirm_required?: boolean;
+            /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+            dynamic_client_registration_enabled?: boolean;
             /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
             canonical_host?: string | null;
             /** @description AuthAccount creation date */
@@ -5603,6 +5717,8 @@ export interface components {
             description: string | null;
             /** @description Optional URL of an image used as the team avatar/logo. */
             logo_url: string | null;
+            /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+            organization?: string | null;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -5657,6 +5773,92 @@ export interface components {
         TeamUpdateMetadata: {
             [key: string]: unknown;
         };
+        /** @description Organization */
+        Organization: {
+            /** @description Organization ID */
+            id: string;
+            /**
+             * @description Human-readable name of the organization.
+             * @example Acme Inc.
+             */
+            name: string;
+            /**
+             * @description URL-safe identifier derived from `name`. Unique within the tenant.
+             * @example acme-inc
+             */
+            slug: string;
+            /** @description Optional free-form description. */
+            description: string | null;
+            /** @description Optional URL of the organization logo. */
+            logo_url: string | null;
+            /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+            admins: string[];
+            /** @description Object is related with this account */
+            account: string;
+            /**
+             * @description OrganizationMetadata
+             * @default {}
+             */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /** @description Organization creation date */
+            createdAt: string;
+            /** @description Organization updated date */
+            updatedAt?: string;
+        };
+        /**
+         * @description OrganizationMetadata
+         * @default {}
+         */
+        OrganizationMetadata: {
+            [key: string]: unknown;
+        };
+        /** @description OrganizationCreate */
+        OrganizationCreate: {
+            /**
+             * @description Human-readable name of the organization.
+             * @example Acme Inc.
+             */
+            name: string;
+            /** @description Optional free-form description. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description Optional URL of the organization logo.
+             */
+            logo_url?: string;
+            /** @description Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`. */
+            admins?: string[];
+            /** @description Add Metadata */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Add Metadata */
+        OrganizationMetadataCreate: {
+            [key: string]: unknown;
+        };
+        /** @description Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`. */
+        OrganizationUpdate: {
+            /** @description New human-readable name. */
+            name?: string;
+            /** @description New free-form description. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description New URL of the organization logo.
+             */
+            logo_url?: string;
+            /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+        OrganizationUpdateMetadata: {
+            [key: string]: unknown;
+        };
         /** @description TeamMember */
         TeamMember: {
             /** @description TeamMember ID */
@@ -6101,8 +6303,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6202,8 +6407,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6297,8 +6505,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6360,8 +6571,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6427,8 +6641,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events?: string[];
             /** @enum {string} */
@@ -6827,6 +7044,7 @@ export interface components {
             default_country_iso?: string | null;
             webauthn_rp_id?: string | null;
             logout_confirm_required?: boolean | null;
+            dynamic_client_registration_enabled?: boolean | null;
             canonical_host?: string | null;
             login_flow?: string | null;
         };
@@ -6864,6 +7082,8 @@ export interface components {
             audience?: string;
             /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
             resource?: string;
+            /** @description client_credentials only. An access token previously returned by this endpoint that a resource server rejected with 401. If it is the cached token for this client, the cache entry is dropped and a new token is issued; otherwise it has no effect. */
+            invalidate_token?: string;
         } & {
             [key: string]: unknown;
         };
@@ -7035,6 +7255,11 @@ export interface components {
          *     - `invite_used` (400): The invite was already accepted.
          *     - `already_member` (400): The user is already a member of the team.
          *     - `not_a_member` (404): The user is not a member of the team.
+         *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
+         *     - `organization_not_found` (404): No organization with that id in this account.
+         *     - `invalid_user` (400): The user does not exist in this account.
+         *     - `not_an_organization_admin` (404): The user is not an admin of the organization.
+         *     - `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.
          *     - `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.
          *     - `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.
          *     - `role_not_found` (404): No role with that id in this account.
@@ -7048,7 +7273,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -7208,6 +7433,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7563,6 +7790,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7806,6 +8035,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7998,6 +8229,7 @@ export interface operations {
                     default_country_iso?: string | null;
                     webauthn_rp_id?: string | null;
                     logout_confirm_required?: boolean | null;
+                    dynamic_client_registration_enabled?: boolean | null;
                     canonical_host?: string | null;
                     login_flow?: string | null;
                 };
@@ -8124,6 +8356,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -9386,6 +9620,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -17706,6 +17942,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -17840,6 +18078,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18003,6 +18243,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18042,6 +18284,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18202,6 +18446,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18342,6 +18588,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18446,51 +18694,66 @@ export interface operations {
             };
         };
     };
-    "teammember/list": {
+    "team/setOrganization": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
-                user?: string;
-                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
-                team?: string;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
-                expand?: ("user" | "team" | "roles")[];
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                team_id: string;
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Id of an Organization of this tenant, or `null` to take the team out of its organization. */
+                    organization: string | null;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description Team */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["TeamMember"][];
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -18498,7 +18761,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -18532,7 +18795,13 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -18540,7 +18809,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "organization_not_found" | "account_not_found";
                     };
                 };
             };
@@ -18570,48 +18839,1194 @@ export interface operations {
             };
         };
     };
-    "teammember/get": {
+    "organization/list": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
-                expand?: ("user" | "team" | "roles")[];
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Full-text search across: `name`, `slug`. */
+                q?: string;
             };
             header?: never;
-            path: {
-                teammember_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description TeamMember */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description TeamMember ID */
-                        id: string;
-                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
-                        user: components["schemas"]["User"] | string | unknown;
-                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
-                        team: components["schemas"]["Team"] | string | unknown;
-                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
-                        roles: (components["schemas"]["Role"] | string | unknown)[];
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description TeamMemberMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description TeamMember creation date */
-                        createdAt: string;
-                        /** @description TeamMember updated date */
-                        updatedAt?: string;
+                        next: string | null;
+                        results: components["schemas"]["Organization"][];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description OrganizationCreate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Human-readable name of the organization.
+                     * @example Acme Inc.
+                     */
+                    name: string;
+                    /** @description Optional free-form description. */
+                    description?: string;
+                    /**
+                     * Format: uri
+                     * @description Optional URL of the organization logo.
+                     */
+                    logo_url?: string;
+                    /** @description Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`. */
+                    admins?: string[];
+                    /** @description Add Metadata */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name. */
+                    name?: string;
+                    /** @description New free-form description. */
+                    description?: string;
+                    /**
+                     * Format: uri
+                     * @description New URL of the organization logo.
+                     */
+                    logo_url?: string;
+                    /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/addAdmin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Id of a user of this tenant.
+                     * @example user_6555fd29a1b2c3d4e5f60718
+                     */
+                    user_id: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_user` — The user does not exist in this account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_user" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/removeAdmin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `not_an_organization_admin` — The user is not an admin of the organization.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "not_an_organization_admin" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `last_organization_admin` — An organization keeps at least one admin. Add another admin before removing this one. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "last_organization_admin";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "teammember/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
+                user?: string;
+                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
+                team?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["TeamMember"][];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "teammember/get": {
+        parameters: {
+            query?: {
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
+            };
+            header?: never;
+            path: {
+                teammember_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description TeamMember */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description TeamMember ID */
+                        id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                        team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                        roles: (components["schemas"]["Role"] | string | unknown)[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description TeamMember creation date */
+                        createdAt: string;
+                        /** @description TeamMember updated date */
+                        updatedAt?: string;
                     };
                 };
             };
@@ -24209,8 +25624,11 @@ export interface operations {
                      *     - `team.invite.created`: An invitation to join a team was created.
                      *     - `team.invite.revoked`: A pending team invitation was revoked.
                      *     - `team.invite.accepted`: A team invitation was accepted.
+                     *     - `organization.created`: An organization was created.
+                     *     - `organization.updated`: An organization was updated (name, settings or admins).
+                     *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                      *
-                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                      */
                     events: string[];
                     /** @enum {string} */
@@ -24284,8 +25702,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24475,8 +25896,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24654,8 +26078,11 @@ export interface operations {
                      *     - `team.invite.created`: An invitation to join a team was created.
                      *     - `team.invite.revoked`: A pending team invitation was revoked.
                      *     - `team.invite.accepted`: A team invitation was accepted.
+                     *     - `organization.created`: An organization was created.
+                     *     - `organization.updated`: An organization was updated (name, settings or admins).
+                     *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                      *
-                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                      */
                     events?: string[];
                     /** @enum {string} */
@@ -24729,8 +26156,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24926,8 +26356,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -28656,6 +30089,8 @@ export interface operations {
                 audience?: string;
                 /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
                 resource?: string;
+                /** @description client_credentials only. An access token previously returned by this endpoint that a resource server rejected with 401. If it is the cached token for this client, the cache entry is dropped and a new token is issued; otherwise it has no effect. */
+                invalidate_token?: string;
             };
             header?: never;
             path?: never;
@@ -28757,6 +30192,8 @@ export interface operations {
                 audience?: string;
                 /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
                 resource?: string;
+                /** @description client_credentials only. An access token previously returned by this endpoint that a resource server rejected with 401. If it is the cached token for this client, the cache entry is dropped and a new token is issued; otherwise it has no effect. */
+                invalidate_token?: string;
             };
             header?: never;
             path?: never;
@@ -28790,6 +30227,8 @@ export interface operations {
                     audience?: string;
                     /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
                     resource?: string;
+                    /** @description client_credentials only. An access token previously returned by this endpoint that a resource server rejected with 401. If it is the cached token for this client, the cache entry is dropped and a new token is issued; otherwise it has no effect. */
+                    invalidate_token?: string;
                 } & {
                     [key: string]: unknown;
                 };
@@ -29840,6 +31279,18 @@ export interface operations {
                     };
                 };
             };
+            /** @description `registration_disabled` — Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "registration_disabled";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {