@faable/auth-sdk 2.7.81 → 2.7.82

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.64.0",
+    "version": "2.65.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -532,6 +532,10 @@
             "type": "boolean",
             "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
           },
+          "dynamic_client_registration_enabled": {
+            "type": "boolean",
+            "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+          },
           "canonical_host": {
             "type": "string",
             "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -3569,6 +3573,11 @@
             "description": "Optional URL of an image used as the team avatar/logo.",
             "nullable": true
           },
+          "organization": {
+            "type": "string",
+            "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+            "nullable": true
+          },
           "account": {
             "type": "string",
             "description": "Object is related with this account"
@@ -3656,6 +3665,158 @@
         "additionalProperties": true,
         "description": "Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely."
       },
+      "Organization": {
+        "type": "object",
+        "required": [
+          "id",
+          "name",
+          "slug",
+          "description",
+          "logo_url",
+          "admins",
+          "account",
+          "createdAt"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Organization ID"
+          },
+          "name": {
+            "type": "string",
+            "description": "Human-readable name of the organization.",
+            "example": "Acme Inc."
+          },
+          "slug": {
+            "type": "string",
+            "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+            "example": "acme-inc"
+          },
+          "description": {
+            "type": "string",
+            "description": "Optional free-form description.",
+            "nullable": true
+          },
+          "logo_url": {
+            "type": "string",
+            "description": "Optional URL of the organization logo.",
+            "nullable": true
+          },
+          "admins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+          },
+          "account": {
+            "type": "string",
+            "description": "Object is related with this account"
+          },
+          "metadata": {
+            "type": "object",
+            "properties": {},
+            "additionalProperties": true,
+            "description": "OrganizationMetadata",
+            "default": {}
+          },
+          "createdAt": {
+            "type": "string",
+            "description": "Organization creation date"
+          },
+          "updatedAt": {
+            "type": "string",
+            "description": "Organization updated date"
+          }
+        },
+        "description": "Organization"
+      },
+      "OrganizationMetadata": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": true,
+        "description": "OrganizationMetadata",
+        "default": {}
+      },
+      "OrganizationCreate": {
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Human-readable name of the organization.",
+            "example": "Acme Inc."
+          },
+          "description": {
+            "type": "string",
+            "description": "Optional free-form description."
+          },
+          "logo_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Optional URL of the organization logo."
+          },
+          "admins": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^user_[0-9a-f]{24}$"
+            },
+            "uniqueItems": true,
+            "description": "Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`."
+          },
+          "metadata": {
+            "type": "object",
+            "properties": {},
+            "additionalProperties": true,
+            "description": "Add Metadata"
+          }
+        },
+        "description": "OrganizationCreate",
+        "additionalProperties": false
+      },
+      "OrganizationMetadataCreate": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": true,
+        "description": "Add Metadata"
+      },
+      "OrganizationUpdate": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "description": "New human-readable name."
+          },
+          "description": {
+            "type": "string",
+            "description": "New free-form description."
+          },
+          "logo_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "New URL of the organization logo."
+          },
+          "metadata": {
+            "type": "object",
+            "properties": {},
+            "additionalProperties": true,
+            "description": "Arbitrary key/value pairs. Replaces the previous metadata entirely."
+          }
+        },
+        "description": "Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`.",
+        "additionalProperties": false
+      },
+      "OrganizationUpdateMetadata": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": true,
+        "description": "Arbitrary key/value pairs. Replaces the previous metadata entirely."
+      },
       "TeamMember": {
         "type": "object",
         "required": [
@@ -5301,7 +5462,7 @@
                 "items": {
                   "type": "string"
                 },
-                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
               },
               "channel": {
                 "type": "string",
@@ -5506,7 +5667,7 @@
             "items": {
               "type": "string"
             },
-            "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+            "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
           },
           "channel": {
             "type": "string",
@@ -5683,7 +5844,7 @@
                 "items": {
                   "type": "string"
                 },
-                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
               },
               "channel": {
                 "type": "string",
@@ -5815,7 +5976,7 @@
             "items": {
               "type": "string"
             },
-            "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+            "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
           },
           "channel": {
             "type": "string",
@@ -5932,7 +6093,7 @@
                 "items": {
                   "type": "string"
                 },
-                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
               },
               "channel": {
                 "type": "string",
@@ -7280,6 +7441,10 @@
               }
             ]
           },
+          "dynamic_client_registration_enabled": {
+            "type": "boolean",
+            "nullable": true
+          },
           "canonical_host": {
             "type": "string",
             "nullable": true
@@ -7615,7 +7780,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -7735,6 +7900,11 @@
           "invite_used",
           "already_member",
           "not_a_member",
+          "registration_disabled",
+          "organization_not_found",
+          "invalid_user",
+          "not_an_organization_admin",
+          "last_organization_admin",
           "team_id_unavailable",
           "use_team_member_route",
           "role_not_found",
@@ -8398,6 +8568,10 @@
                       "type": "boolean",
                       "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
                     },
+                    "dynamic_client_registration_enabled": {
+                      "type": "boolean",
+                      "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -9142,6 +9316,10 @@
                       "type": "boolean",
                       "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
                     },
+                    "dynamic_client_registration_enabled": {
+                      "type": "boolean",
+                      "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -10123,6 +10301,10 @@
                       "type": "boolean",
                       "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
                     },
+                    "dynamic_client_registration_enabled": {
+                      "type": "boolean",
+                      "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -10748,6 +10930,10 @@
                       }
                     ]
                   },
+                  "dynamic_client_registration_enabled": {
+                    "type": "boolean",
+                    "nullable": true
+                  },
                   "canonical_host": {
                     "type": "string",
                     "nullable": true
@@ -11280,6 +11466,10 @@
                       "type": "boolean",
                       "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
                     },
+                    "dynamic_client_registration_enabled": {
+                      "type": "boolean",
+                      "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -14222,6 +14412,10 @@
                       "type": "boolean",
                       "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
                     },
+                    "dynamic_client_registration_enabled": {
+                      "type": "boolean",
+                      "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -32775,39 +32969,2248 @@
         }
       }
     },
-    "/rolemember/{rolemember_id}": {
-      "get": {
-        "operationId": "rolemember/get",
-        "summary": "Get Rolemember",
+    "/rolemember/{rolemember_id}": {
+      "get": {
+        "operationId": "rolemember/get",
+        "summary": "Get Rolemember",
+        "tags": [
+          "rolemember"
+        ],
+        "description": "Get Rolemember",
+        "parameters": [
+          {
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "user",
+                  "role"
+                ],
+                "description": "Allowed expand paths on `rolemember`: `user`, `role`."
+              },
+              "maxItems": 2
+            },
+            "in": "query",
+            "name": "expand",
+            "required": false,
+            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "rolemember_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "RoleMember",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "role",
+                    "user",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "RoleMember ID"
+                    },
+                    "role": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Role"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ],
+                      "description": "Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object."
+                    },
+                    "user": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/User"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ],
+                      "description": "User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "RoleMemberMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "RoleMember creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "RoleMember updated date"
+                    }
+                  },
+                  "description": "RoleMember"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "invalid_expand",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "rolemember/delete",
+        "summary": "Delete Rolemember",
+        "tags": [
+          "rolemember"
+        ],
+        "description": "Delete Rolemember",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "rolemember_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "RoleMember",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "role",
+                    "user",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "RoleMember ID"
+                    },
+                    "role": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Role"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ],
+                      "description": "Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object."
+                    },
+                    "user": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/User"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ],
+                      "description": "User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "RoleMemberMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "RoleMember creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "RoleMember updated date"
+                    }
+                  },
+                  "description": "RoleMember"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/team": {
+      "get": {
+        "operationId": "team/list",
+        "summary": "List Teams",
+        "tags": [
+          "team"
+        ],
+        "description": "List Teams",
+        "parameters": [
+          {
+            "schema": {
+              "type": "number",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "in": "query",
+            "name": "pageSize",
+            "required": false,
+            "description": "Number of items per page (max 200)"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "description": "Cursor for next page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "next",
+            "required": false,
+            "description": "Cursor returned by the previous page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "query",
+            "required": false,
+            "description": "Filter using a FaableQL query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `name`, `slug`."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "next",
+                    "results"
+                  ],
+                  "properties": {
+                    "next": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Team"
+                      }
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_query",
+                            "invalid_expand",
+                            "search_not_supported",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "operationId": "team/create",
+        "summary": "Create Team",
+        "tags": [
+          "team"
+        ],
+        "description": "Create Team",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "Human-readable name of the team.",
+                    "example": "Acme Engineering"
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "Optional free-form description of the team."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Add Metadata"
+                  }
+                },
+                "description": "TeamCreate",
+                "additionalProperties": false
+              }
+            }
+          },
+          "description": "TeamCreate"
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "already_exists",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/team/{team_id}": {
+      "get": {
+        "operationId": "team/get",
+        "summary": "Get Team",
+        "tags": [
+          "team"
+        ],
+        "description": "Get Team",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "team_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "invalid_expand",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "operationId": "team/update",
+        "summary": "Update Team",
+        "tags": [
+          "team"
+        ],
+        "description": "Update Team",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "New human-readable name for the team."
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "New free-form description for the team."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely."
+                  }
+                },
+                "description": "Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable.",
+                "additionalProperties": false
+              }
+            }
+          },
+          "description": "Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable."
+        },
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "team_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "already_exists",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "team/delete",
+        "summary": "Delete Team",
+        "tags": [
+          "team"
+        ],
+        "description": "Delete Team",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "team_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "put": {
+        "operationId": "team/put",
+        "summary": "Create or update a Team with a given id",
+        "tags": [
+          "team"
+        ],
+        "description": "Creates the Team with the given id if it does not exist in this tenant (201), or updates its name, description, metadata and — when given — slug (200). Idempotent. Needs both `create:teams` and `update:teams`. `team_id_unavailable` (409) when the id cannot be used in this tenant; `already_exists` when the slug is taken by another team.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Human-readable name of the team.",
+                    "example": "Acme Engineering"
+                  },
+                  "slug": {
+                    "type": "string",
+                    "minLength": 1,
+                    "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                    "description": "URL-safe identifier, unique within the tenant. Derived from `name` when omitted on creation; when given, it is set as-is (also on update). Pass it when names can repeat.",
+                    "example": "acme-engineering"
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "Optional free-form description."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely."
+                  }
+                },
+                "additionalProperties": false,
+                "description": "Payload for creating or updating a Team under a caller-chosen id."
+              }
+            }
+          },
+          "description": "Payload for creating or updating a Team under a caller-chosen id."
+        },
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "pattern": "^team_[0-9a-f]{24}$"
+            },
+            "in": "path",
+            "name": "team_id",
+            "required": true,
+            "description": "Id of the team to create or update: `team_` followed by 24 lowercase hex characters, chosen by the caller."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Team",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Team ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "TeamMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Team creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Team updated date"
+                    }
+                  },
+                  "description": "Team"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "already_exists",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "`team_id_unavailable` — The team id cannot be used in this tenant. Pick another id or let the API generate one.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "team_id_unavailable"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/team/{team_id}/organization": {
+      "put": {
+        "operationId": "team/setOrganization",
+        "summary": "Put a Team in an Organization, or take it out",
         "tags": [
-          "rolemember"
+          "team"
         ],
-        "description": "Get Rolemember",
-        "parameters": [
-          {
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "enum": [
-                  "user",
-                  "role"
+        "description": "Sets the Organization the Team belongs to (`null` = none). A team is in at most one organization; setting another one moves it. Belonging to an organization grants nobody access to the team. Emits `team.updated`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "organization"
                 ],
-                "description": "Allowed expand paths on `rolemember`: `user`, `role`."
-              },
-              "maxItems": 2
-            },
-            "in": "query",
-            "name": "expand",
-            "required": false,
-            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
-          },
+                "properties": {
+                  "organization": {
+                    "type": "string",
+                    "description": "Id of an Organization of this tenant, or `null` to take the team out of its organization.",
+                    "nullable": true
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "parameters": [
           {
             "schema": {
               "type": "string"
             },
             "in": "path",
-            "name": "rolemember_id",
+            "name": "team_id",
             "required": true
           }
         ],
@@ -32818,46 +35221,49 @@
         ],
         "responses": {
           "200": {
-            "description": "RoleMember",
+            "description": "Team",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
                     "id",
-                    "role",
-                    "user",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "RoleMember ID"
+                      "description": "Team ID"
                     },
-                    "role": {
-                      "anyOf": [
-                        {
-                          "$ref": "#/components/schemas/Role"
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {}
-                      ],
-                      "description": "Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object."
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
+                      "example": "Acme Engineering"
                     },
-                    "user": {
-                      "anyOf": [
-                        {
-                          "$ref": "#/components/schemas/User"
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {}
-                      ],
-                      "description": "User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object."
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
+                      "example": "acme-engineering"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description of the team.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "nullable": true
+                    },
+                    "organization": {
+                      "type": "string",
+                      "description": "Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`.",
+                      "nullable": true
                     },
                     "account": {
                       "type": "string",
@@ -32867,25 +35273,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "RoleMemberMetadata",
+                      "description": "TeamMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "RoleMember creation date"
+                      "description": "Team creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "RoleMember updated date"
+                      "description": "Team updated date"
                     }
                   },
-                  "description": "RoleMember"
+                  "description": "Team"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -32899,8 +35305,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
-                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -32964,7 +35368,7 @@
             }
           },
           "404": {
-            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`not_found` — The resource does not exist in this account.\n\n`organization_not_found` — No organization with that id in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -32979,6 +35383,7 @@
                           "type": "string",
                           "enum": [
                             "not_found",
+                            "organization_not_found",
                             "account_not_found"
                           ]
                         }
@@ -33040,22 +35445,65 @@
             }
           }
         }
-      },
-      "delete": {
-        "operationId": "rolemember/delete",
-        "summary": "Delete Rolemember",
+      }
+    },
+    "/organization": {
+      "get": {
+        "operationId": "organization/list",
+        "summary": "List Organizations",
         "tags": [
-          "rolemember"
+          "organization"
         ],
-        "description": "Delete Rolemember",
+        "description": "List Organizations",
         "parameters": [
+          {
+            "schema": {
+              "type": "number",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "in": "query",
+            "name": "pageSize",
+            "required": false,
+            "description": "Number of items per page (max 200)"
+          },
           {
             "schema": {
               "type": "string"
             },
-            "in": "path",
-            "name": "rolemember_id",
-            "required": true
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "description": "Cursor for next page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "next",
+            "required": false,
+            "description": "Cursor returned by the previous page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "query",
+            "required": false,
+            "description": "Filter using a FaableQL query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `name`, `slug`."
           }
         ],
         "security": [
@@ -33065,74 +35513,40 @@
         ],
         "responses": {
           "200": {
-            "description": "RoleMember",
+            "description": "Default Response",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
-                    "id",
-                    "role",
-                    "user",
-                    "account",
-                    "createdAt"
+                    "next",
+                    "results"
                   ],
                   "properties": {
-                    "id": {
-                      "type": "string",
-                      "description": "RoleMember ID"
-                    },
-                    "role": {
+                    "next": {
                       "anyOf": [
-                        {
-                          "$ref": "#/components/schemas/Role"
-                        },
                         {
                           "type": "string"
                         },
-                        {}
-                      ],
-                      "description": "Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object."
-                    },
-                    "user": {
-                      "anyOf": [
                         {
-                          "$ref": "#/components/schemas/User"
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {}
-                      ],
-                      "description": "User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object."
-                    },
-                    "account": {
-                      "type": "string",
-                      "description": "Object is related with this account"
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": true,
-                      "description": "RoleMemberMetadata",
-                      "default": {}
-                    },
-                    "createdAt": {
-                      "type": "string",
-                      "description": "RoleMember creation date"
+                          "type": "null"
+                        }
+                      ]
                     },
-                    "updatedAt": {
-                      "type": "string",
-                      "description": "RoleMember updated date"
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Organization"
+                      }
                     }
                   },
-                  "description": "RoleMember"
+                  "additionalProperties": false
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -33146,7 +35560,9 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
+                            "invalid_query",
+                            "invalid_expand",
+                            "search_not_supported",
                             "validation_error"
                           ]
                         }
@@ -33210,7 +35626,7 @@
             }
           },
           "404": {
-            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -33224,7 +35640,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "not_found",
                             "account_not_found"
                           ]
                         }
@@ -33286,67 +35701,62 @@
             }
           }
         }
-      }
-    },
-    "/team": {
-      "get": {
-        "operationId": "team/list",
-        "summary": "List Teams",
+      },
+      "post": {
+        "operationId": "organization/create",
+        "summary": "Create Organization",
         "tags": [
-          "team"
+          "organization"
         ],
-        "description": "List Teams",
-        "parameters": [
-          {
-            "schema": {
-              "type": "number",
-              "minimum": 1,
-              "maximum": 200
-            },
-            "in": "query",
-            "name": "pageSize",
-            "required": false,
-            "description": "Number of items per page (max 200)"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "cursor",
-            "required": false,
-            "description": "Cursor for next page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "next",
-            "required": false,
-            "description": "Cursor returned by the previous page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "query",
-            "required": false,
-            "description": "Filter using a FaableQL query"
+        "description": "Create Organization",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Human-readable name of the organization.",
+                    "example": "Acme Inc."
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "Optional free-form description."
+                  },
+                  "logo_url": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Optional URL of the organization logo."
+                  },
+                  "admins": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "pattern": "^user_[0-9a-f]{24}$"
+                    },
+                    "uniqueItems": true,
+                    "description": "Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Add Metadata"
+                  }
+                },
+                "description": "OrganizationCreate",
+                "additionalProperties": false
+              }
+            }
           },
-          {
-            "schema": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 200
-            },
-            "in": "query",
-            "name": "q",
-            "required": false,
-            "description": "Full-text search across: `name`, `slug`."
-          }
-        ],
+          "description": "OrganizationCreate"
+        },
         "security": [
           {
             "bearerAuth": []
@@ -33354,40 +35764,80 @@
         ],
         "responses": {
           "200": {
-            "description": "Default Response",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
-                    "next",
-                    "results"
+                    "id",
+                    "name",
+                    "slug",
+                    "description",
+                    "logo_url",
+                    "admins",
+                    "account",
+                    "createdAt"
                   ],
                   "properties": {
-                    "next": {
-                      "anyOf": [
-                        {
-                          "type": "string"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
+                    "id": {
+                      "type": "string",
+                      "description": "Organization ID"
                     },
-                    "results": {
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional free-form description.",
+                      "nullable": true
+                    },
+                    "logo_url": {
+                      "type": "string",
+                      "description": "Optional URL of the organization logo.",
+                      "nullable": true
+                    },
+                    "admins": {
                       "type": "array",
                       "items": {
-                        "$ref": "#/components/schemas/Team"
-                      }
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "OrganizationMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Organization creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Organization updated date"
                     }
                   },
-                  "additionalProperties": false
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -33401,9 +35851,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_query",
-                            "invalid_expand",
-                            "search_not_supported",
+                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -33542,47 +35990,26 @@
             }
           }
         }
-      },
-      "post": {
-        "operationId": "team/create",
-        "summary": "Create Team",
+      }
+    },
+    "/organization/{organization_id}": {
+      "get": {
+        "operationId": "organization/get",
+        "summary": "Get Organization",
         "tags": [
-          "team"
+          "organization"
+        ],
+        "description": "Get Organization",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "organization_id",
+            "required": true
+          }
         ],
-        "description": "Create Team",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "name"
-                ],
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "description": "Human-readable name of the team.",
-                    "example": "Acme Engineering"
-                  },
-                  "description": {
-                    "type": "string",
-                    "description": "Optional free-form description of the team."
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "properties": {},
-                    "additionalProperties": true,
-                    "description": "Add Metadata"
-                  }
-                },
-                "description": "TeamCreate",
-                "additionalProperties": false
-              }
-            }
-          },
-          "description": "TeamCreate"
-        },
         "security": [
           {
             "bearerAuth": []
@@ -33590,7 +36017,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Team",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
@@ -33601,34 +36028,42 @@
                     "slug",
                     "description",
                     "logo_url",
+                    "admins",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Team ID"
+                      "description": "Organization ID"
                     },
                     "name": {
                       "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
                     },
                     "slug": {
                       "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
                     },
                     "description": {
                       "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional free-form description.",
                       "nullable": true
                     },
                     "logo_url": {
                       "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "description": "Optional URL of the organization logo.",
                       "nullable": true
                     },
+                    "admins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+                    },
                     "account": {
                       "type": "string",
                       "description": "Object is related with this account"
@@ -33637,25 +36072,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "TeamMetadata",
+                      "description": "OrganizationMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Team creation date"
+                      "description": "Organization creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Team updated date"
+                      "description": "Organization updated date"
                     }
                   },
-                  "description": "Team"
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -33669,7 +36104,8 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "already_exists",
+                            "invalid_id",
+                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -33733,7 +36169,7 @@
             }
           },
           "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -33747,6 +36183,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
+                            "not_found",
                             "account_not_found"
                           ]
                         }
@@ -33808,23 +36245,56 @@
             }
           }
         }
-      }
-    },
-    "/team/{team_id}": {
-      "get": {
-        "operationId": "team/get",
-        "summary": "Get Team",
+      },
+      "post": {
+        "operationId": "organization/update",
+        "summary": "Update Organization",
         "tags": [
-          "team"
+          "organization"
         ],
-        "description": "Get Team",
+        "description": "Update Organization",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "New human-readable name."
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "New free-form description."
+                  },
+                  "logo_url": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "New URL of the organization logo."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Arbitrary key/value pairs. Replaces the previous metadata entirely."
+                  }
+                },
+                "description": "Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`.",
+                "additionalProperties": false
+              }
+            }
+          },
+          "description": "Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`."
+        },
         "parameters": [
           {
             "schema": {
               "type": "string"
             },
             "in": "path",
-            "name": "team_id",
+            "name": "organization_id",
             "required": true
           }
         ],
@@ -33835,7 +36305,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Team",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
@@ -33846,34 +36316,42 @@
                     "slug",
                     "description",
                     "logo_url",
+                    "admins",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Team ID"
+                      "description": "Organization ID"
                     },
                     "name": {
                       "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
                     },
                     "slug": {
                       "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
                     },
                     "description": {
                       "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional free-form description.",
                       "nullable": true
                     },
                     "logo_url": {
                       "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "description": "Optional URL of the organization logo.",
                       "nullable": true
                     },
+                    "admins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+                    },
                     "account": {
                       "type": "string",
                       "description": "Object is related with this account"
@@ -33882,25 +36360,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "TeamMetadata",
+                      "description": "OrganizationMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Team creation date"
+                      "description": "Organization creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Team updated date"
+                      "description": "Organization updated date"
                     }
                   },
-                  "description": "Team"
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -33915,7 +36393,7 @@
                           "type": "string",
                           "enum": [
                             "invalid_id",
-                            "invalid_expand",
+                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -34056,49 +36534,20 @@
           }
         }
       },
-      "post": {
-        "operationId": "team/update",
-        "summary": "Update Team",
+      "delete": {
+        "operationId": "organization/delete",
+        "summary": "Delete Organization",
         "tags": [
-          "team"
+          "organization"
         ],
-        "description": "Update Team",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "description": "New human-readable name for the team."
-                  },
-                  "description": {
-                    "type": "string",
-                    "description": "New free-form description for the team."
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "properties": {},
-                    "additionalProperties": true,
-                    "description": "Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely."
-                  }
-                },
-                "description": "Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable.",
-                "additionalProperties": false
-              }
-            }
-          },
-          "description": "Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable."
-        },
+        "description": "Delete Organization",
         "parameters": [
           {
             "schema": {
               "type": "string"
             },
             "in": "path",
-            "name": "team_id",
+            "name": "organization_id",
             "required": true
           }
         ],
@@ -34109,7 +36558,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Team",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
@@ -34120,34 +36569,42 @@
                     "slug",
                     "description",
                     "logo_url",
+                    "admins",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Team ID"
+                      "description": "Organization ID"
                     },
                     "name": {
                       "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
                     },
                     "slug": {
                       "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
                     },
                     "description": {
                       "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional free-form description.",
                       "nullable": true
                     },
                     "logo_url": {
                       "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "description": "Optional URL of the organization logo.",
                       "nullable": true
                     },
+                    "admins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+                    },
                     "account": {
                       "type": "string",
                       "description": "Object is related with this account"
@@ -34156,25 +36613,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "TeamMetadata",
+                      "description": "OrganizationMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Team creation date"
+                      "description": "Organization creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Team updated date"
+                      "description": "Organization updated date"
                     }
                   },
-                  "description": "Team"
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -34189,7 +36646,6 @@
                           "type": "string",
                           "enum": [
                             "invalid_id",
-                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -34329,21 +36785,44 @@
             }
           }
         }
-      },
-      "delete": {
-        "operationId": "team/delete",
-        "summary": "Delete Team",
+      }
+    },
+    "/organization/{organization_id}/admin": {
+      "post": {
+        "operationId": "organization/addAdmin",
+        "summary": "Add an admin to an Organization",
         "tags": [
-          "team"
+          "organization"
         ],
-        "description": "Delete Team",
+        "description": "Makes a user of this tenant an admin of the Organization. Idempotent. Being an admin does not grant access to any team of the organization. Emits `organization.updated`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "user_id"
+                ],
+                "properties": {
+                  "user_id": {
+                    "type": "string",
+                    "description": "Id of a user of this tenant.",
+                    "example": "user_6555fd29a1b2c3d4e5f60718"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
         "parameters": [
           {
             "schema": {
               "type": "string"
             },
             "in": "path",
-            "name": "team_id",
+            "name": "organization_id",
             "required": true
           }
         ],
@@ -34354,7 +36833,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Team",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
@@ -34365,34 +36844,42 @@
                     "slug",
                     "description",
                     "logo_url",
+                    "admins",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Team ID"
+                      "description": "Organization ID"
                     },
                     "name": {
                       "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
                     },
                     "slug": {
                       "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
                     },
                     "description": {
                       "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional free-form description.",
                       "nullable": true
                     },
                     "logo_url": {
                       "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
+                      "description": "Optional URL of the organization logo.",
                       "nullable": true
                     },
+                    "admins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
+                    },
                     "account": {
                       "type": "string",
                       "description": "Object is related with this account"
@@ -34401,25 +36888,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "TeamMetadata",
+                      "description": "OrganizationMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Team creation date"
+                      "description": "Organization creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Team updated date"
+                      "description": "Organization updated date"
                     }
                   },
-                  "description": "Team"
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_user` — The user does not exist in this account.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -34433,7 +36920,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
+                            "invalid_user",
                             "validation_error"
                           ]
                         }
@@ -34497,7 +36984,7 @@
             }
           },
           "404": {
-            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`organization_not_found` — No organization with that id in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -34511,7 +36998,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "not_found",
+                            "organization_not_found",
                             "account_not_found"
                           ]
                         }
@@ -34573,65 +37060,32 @@
             }
           }
         }
-      },
-      "put": {
-        "operationId": "team/put",
-        "summary": "Create or update a Team with a given id",
+      }
+    },
+    "/organization/{organization_id}/admin/{user_id}": {
+      "delete": {
+        "operationId": "organization/removeAdmin",
+        "summary": "Remove an admin from an Organization",
         "tags": [
-          "team"
+          "organization"
         ],
-        "description": "Creates the Team with the given id if it does not exist in this tenant (201), or updates its name, description, metadata and — when given — slug (200). Idempotent. Needs both `create:teams` and `update:teams`. `team_id_unavailable` (409) when the id cannot be used in this tenant; `already_exists` when the slug is taken by another team.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "name"
-                ],
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "minLength": 1,
-                    "description": "Human-readable name of the team.",
-                    "example": "Acme Engineering"
-                  },
-                  "slug": {
-                    "type": "string",
-                    "minLength": 1,
-                    "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-                    "description": "URL-safe identifier, unique within the tenant. Derived from `name` when omitted on creation; when given, it is set as-is (also on update). Pass it when names can repeat.",
-                    "example": "acme-engineering"
-                  },
-                  "description": {
-                    "type": "string",
-                    "description": "Optional free-form description."
-                  },
-                  "metadata": {
-                    "type": "object",
-                    "properties": {},
-                    "additionalProperties": true,
-                    "description": "Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely."
-                  }
-                },
-                "additionalProperties": false,
-                "description": "Payload for creating or updating a Team under a caller-chosen id."
-              }
-            }
-          },
-          "description": "Payload for creating or updating a Team under a caller-chosen id."
-        },
+        "description": "Removes the user from the admins of the Organization (the user is not deleted). An organization keeps at least one admin: removing the last one is `last_organization_admin`. Emits `organization.updated`.",
         "parameters": [
           {
             "schema": {
-              "type": "string",
-              "pattern": "^team_[0-9a-f]{24}$"
+              "type": "string"
             },
             "in": "path",
-            "name": "team_id",
-            "required": true,
-            "description": "Id of the team to create or update: `team_` followed by 24 lowercase hex characters, chosen by the caller."
+            "name": "organization_id",
+            "required": true
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "user_id",
+            "required": true
           }
         ],
         "security": [
@@ -34641,7 +37095,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Team",
+            "description": "Organization",
             "content": {
               "application/json": {
                 "schema": {
@@ -34652,98 +37106,41 @@
                     "slug",
                     "description",
                     "logo_url",
+                    "admins",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Team ID"
+                      "description": "Organization ID"
                     },
                     "name": {
                       "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
+                      "description": "Human-readable name of the organization.",
+                      "example": "Acme Inc."
                     },
                     "slug": {
                       "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
+                      "description": "URL-safe identifier derived from `name`. Unique within the tenant.",
+                      "example": "acme-inc"
                     },
                     "description": {
                       "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional free-form description.",
                       "nullable": true
                     },
                     "logo_url": {
                       "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
-                      "nullable": true
-                    },
-                    "account": {
-                      "type": "string",
-                      "description": "Object is related with this account"
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": true,
-                      "description": "TeamMetadata",
-                      "default": {}
-                    },
-                    "createdAt": {
-                      "type": "string",
-                      "description": "Team creation date"
-                    },
-                    "updatedAt": {
-                      "type": "string",
-                      "description": "Team updated date"
-                    }
-                  },
-                  "description": "Team"
-                }
-              }
-            }
-          },
-          "201": {
-            "description": "Team",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "id",
-                    "name",
-                    "slug",
-                    "description",
-                    "logo_url",
-                    "account",
-                    "createdAt"
-                  ],
-                  "properties": {
-                    "id": {
-                      "type": "string",
-                      "description": "Team ID"
-                    },
-                    "name": {
-                      "type": "string",
-                      "description": "Human-readable name of the team. Shown in the dashboard and in team-picker UI.",
-                      "example": "Acme Engineering"
-                    },
-                    "slug": {
-                      "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.",
-                      "example": "acme-engineering"
-                    },
-                    "description": {
-                      "type": "string",
-                      "description": "Optional free-form description of the team.",
+                      "description": "Optional URL of the organization logo.",
                       "nullable": true
                     },
-                    "logo_url": {
-                      "type": "string",
-                      "description": "Optional URL of an image used as the team avatar/logo.",
-                      "nullable": true
+                    "admins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership."
                     },
                     "account": {
                       "type": "string",
@@ -34753,25 +37150,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "TeamMetadata",
+                      "description": "OrganizationMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Team creation date"
+                      "description": "Organization creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Team updated date"
+                      "description": "Organization updated date"
                     }
                   },
-                  "description": "Team"
+                  "description": "Organization"
                 }
               }
             }
           },
           "400": {
-            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -34785,7 +37182,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -34849,7 +37245,7 @@
             }
           },
           "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`organization_not_found` — No organization with that id in this account.\n\n`not_an_organization_admin` — The user is not an admin of the organization.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -34863,6 +37259,8 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
+                            "organization_not_found",
+                            "not_an_organization_admin",
                             "account_not_found"
                           ]
                         }
@@ -34874,7 +37272,7 @@
             }
           },
           "409": {
-            "description": "`team_id_unavailable` — The team id cannot be used in this tenant. Pick another id or let the API generate one.",
+            "description": "`last_organization_admin` — An organization keeps at least one admin. Add another admin before removing this one.",
             "content": {
               "application/json": {
                 "schema": {
@@ -34888,7 +37286,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "team_id_unavailable"
+                            "last_organization_admin"
                           ]
                         }
                       }
@@ -49845,7 +52243,7 @@
                         "items": {
                           "type": "string"
                         },
-                        "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                        "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                       },
                       "channel": {
                         "type": "string",
@@ -49998,7 +52396,7 @@
                           "items": {
                             "type": "string"
                           },
-                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                         },
                         "channel": {
                           "type": "string",
@@ -50368,7 +52766,7 @@
                           "items": {
                             "type": "string"
                           },
-                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                         },
                         "channel": {
                           "type": "string",
@@ -50678,7 +53076,7 @@
                         "items": {
                           "type": "string"
                         },
-                        "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                        "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                       },
                       "channel": {
                         "type": "string",
@@ -50835,7 +53233,7 @@
                           "items": {
                             "type": "string"
                           },
-                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                         },
                         "channel": {
                           "type": "string",
@@ -51205,7 +53603,7 @@
                           "items": {
                             "type": "string"
                           },
-                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n\n`team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
+                          "description": "Events to subscribe to. For `webhook` subscriptions it must be a subset of the published catalog; any other value is rejected with a 400:\n\n- `user.created`: A user was created (signup, import or Management API).\n- `user.updated`: A user was updated.\n- `user.deleted`: A user was deleted.\n- `auth.login`: A user logged in.\n- `credentials.exported`: Someone exported the tenant's password hashes (`GET /user/export` with hashes).\n- `team.created`: A team was created.\n- `team.updated`: A team was updated.\n- `team.deleted`: A team was deleted.\n- `team.member.added`: A user was added to a team.\n- `team.member.updated`: A team member's roles changed.\n- `team.member.removed`: A user was removed from a team (or left it).\n- `team.invite.created`: An invitation to join a team was created.\n- `team.invite.revoked`: A pending team invitation was revoked.\n- `team.invite.accepted`: A team invitation was accepted.\n- `organization.created`: An organization was created.\n- `organization.updated`: An organization was updated (name, settings or admins).\n- `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.\n\n`team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it."
                         },
                         "channel": {
                           "type": "string",
@@ -64658,7 +67056,7 @@
         "tags": [
           "oauth"
         ],
-        "description": "Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context.",
+        "description": "Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context. Only when the tenant has `dynamic_client_registration_enabled`; otherwise `registration_disabled` (403).",
         "requestBody": {
           "required": true,
           "content": {
@@ -64926,6 +67324,31 @@
               }
             }
           },
+          "403": {
+            "description": "`registration_disabled` — Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "registration_disabled"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "404": {
             "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {