@faable/auth-sdk 2.7.82 → 2.7.84

package/dist/api/types.d.ts

@@ -1308,6 +1308,86 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/organization/{organization_id}/domain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Claim an email domain for an Organization
+         * @description Adds the domain unverified, with the `verification_token` its TXT record must hold. Idempotent. Nothing changes for anyone until the domain is verified.
+         */
+        post: operations["organization/addDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/domain/{domain}/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify an Organization's email domain
+         * @description Looks up the TXT record `_faable-challenge.<domain>` and, when it holds `faable-verification=<verification_token>`, marks the domain verified. Pro plan (`plan_required`; `plan_unavailable` when the plan cannot be checked). A domain is verified by one organization of the tenant at most (`organization_domain_taken`).
+         */
+        post: operations["organization/verifyDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/domain/{domain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an email domain from an Organization
+         * @description Removes the domain, verified or not. Logins of people already in the organization are unaffected.
+         */
+        delete: operations["organization/removeDomain"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/auto-join": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set an Organization's auto-join rules
+         * @description Replaces the auto-join rules: whoever signs in with a verified email of one of the verified domains joins these teams (of this organization) with these roles. Nobody already a member is changed. Pro plan to turn it on; an empty list turns it off and is always allowed.
+         */
+        put: operations["organization/setAutoJoin"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/teammember": {
         parameters: {
             query?: never;
@@ -4886,6 +4966,8 @@ export interface components {
             /** @default null */
             response_type: string;
             enabled: boolean;
+            /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+            organization?: string | null;
             /** @default null */
             enabled_clients: string[] | null;
             /** @default [] */
@@ -4948,6 +5030,10 @@ export interface components {
             client_secret?: string;
             issuer?: string;
             jwks_url?: string;
+            token_url?: string;
+            userinfo_url?: string;
+            /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+            organization?: string;
             scope?: string[];
             enabled?: boolean;
             claims_mapping?: {
@@ -5024,6 +5110,7 @@ export interface components {
             disable_signup?: boolean;
             /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
             login_identifier?: "email" | "username" | "email_or_username";
+            organization?: string | null;
         };
         /** @description Presentation metadata for one connection type. Contains no endpoint URLs and no credentials. */
         ConnectionTypeInfo: {
@@ -5791,6 +5878,25 @@ export interface components {
             description: string | null;
             /** @description Optional URL of the organization logo. */
             logo_url: string | null;
+            /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+            domains: {
+                /** @example acme.com */
+                domain: string;
+                /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                verification_token: string;
+                /**
+                 * Format: date-time
+                 * @description When the TXT record was found. `null` = not verified.
+                 */
+                verified_at: string | null;
+            }[];
+            /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+            auto_join: {
+                /** @description A team of this organization. */
+                team: string;
+                /** @description Role ids the member gets in that team. */
+                roles: string[];
+            }[];
             /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
             admins: string[];
             /** @description Object is related with this account */
@@ -7256,6 +7362,14 @@ export interface components {
          *     - `already_member` (400): The user is already a member of the team.
          *     - `not_a_member` (404): The user is not a member of the team.
          *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
+         *     - `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+         *     - `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+         *     - `organization_domain_not_found` (404): The organization has no such domain.
+         *     - `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.
+         *     - `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.
+         *     - `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.
+         *     - `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.
+         *     - `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.
          *     - `organization_not_found` (404): No organization with that id in this account.
          *     - `invalid_user` (400): The user does not exist in this account.
          *     - `not_an_organization_admin` (404): The user is not an admin of the organization.
@@ -7273,7 +7387,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -9860,6 +9974,10 @@ export interface operations {
                     client_secret?: string;
                     issuer?: string;
                     jwks_url?: string;
+                    token_url?: string;
+                    userinfo_url?: string;
+                    /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                    organization?: string;
                     scope?: string[];
                     enabled?: boolean;
                     claims_mapping?: {
@@ -9928,6 +10046,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10099,6 +10219,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10283,6 +10405,7 @@ export interface operations {
                     disable_signup?: boolean;
                     /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
                     login_identifier?: "email" | "username" | "email_or_username";
+                    organization?: string | null;
                 };
             };
         };
@@ -10316,6 +10439,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10493,6 +10618,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10814,6 +10941,15 @@ export interface operations {
                 content: {
                     "application/json": {
                         ok: boolean;
+                        /** @description The identifier is an email of an organization's verified domain, and that organization has its own identity provider: continue with `/authorize?resume_state=<state>&connection=<connection_id>` instead of the method chooser (arch/auth/sso.md F3). */
+                        home_realm?: {
+                            connection_id: string;
+                            organization: {
+                                id: string;
+                                name: string;
+                                logo_url: string | null;
+                            };
+                        };
                     };
                 };
             };
@@ -19015,6 +19151,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19151,6 +19306,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19312,6 +19486,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19454,6 +19647,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19604,6 +19816,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19745,6 +19976,25 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of the organization logo. */
                         logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19861,6 +20111,747 @@ export interface operations {
             };
         };
     };
+    "organization/addDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description The email domain, as in `alice@<domain>`.
+                     * @example acme.com
+                     */
+                    domain: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_email_domain` — Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+             *
+             *     `public_email_domain` — A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_email_domain" | "public_email_domain" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/verifyDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization */
+                        organization: {
+                            /** @description Organization ID */
+                            id: string;
+                            /**
+                             * @description Human-readable name of the organization.
+                             * @example Acme Inc.
+                             */
+                            name: string;
+                            /**
+                             * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                             * @example acme-inc
+                             */
+                            slug: string;
+                            /** @description Optional free-form description. */
+                            description: string | null;
+                            /** @description Optional URL of the organization logo. */
+                            logo_url: string | null;
+                            /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                            domains: {
+                                /** @example acme.com */
+                                domain: string;
+                                /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                                verification_token: string;
+                                /**
+                                 * Format: date-time
+                                 * @description When the TXT record was found. `null` = not verified.
+                                 */
+                                verified_at: string | null;
+                            }[];
+                            /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                            auto_join: {
+                                /** @description A team of this organization. */
+                                team: string;
+                                /** @description Role ids the member gets in that team. */
+                                roles: string[];
+                            }[];
+                            /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                            admins: string[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description OrganizationMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description Organization creation date */
+                            createdAt: string;
+                            /** @description Organization updated date */
+                            updatedAt?: string;
+                        };
+                        /** @description `null` when the domain was already verified. */
+                        record: {
+                            /** @enum {string} */
+                            type: "TXT";
+                            host: string;
+                            expected: string;
+                            observed: string[];
+                            ok: boolean;
+                        } | null;
+                    };
+                };
+            };
+            /**
+             * @description `organization_domain_unverified` — The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.
+             *
+             *     `invalid_email_domain` — Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+             *
+             *     `public_email_domain` — A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_domain_unverified" | "invalid_email_domain" | "public_email_domain" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /** @description `plan_required` — The setting requires a higher plan. `message` says which. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_required";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `organization_domain_not_found` — The organization has no such domain.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "organization_domain_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `organization_domain_taken` — Another organization of this tenant already verified this domain. A domain belongs to one organization. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_domain_taken";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+            /** @description `plan_unavailable` — The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_unavailable";
+                    };
+                };
+            };
+        };
+    };
+    "organization/removeDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `organization_domain_not_found` — The organization has no such domain.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "organization_domain_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/setAutoJoin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    auto_join: {
+                        /** @description A team of this organization. */
+                        team: string;
+                        /** @description Role ids of this tenant. */
+                        roles: string[];
+                    }[];
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `team_not_in_organization` — Auto-join can only put people in teams of the same organization. `details.teams` lists the others.
+             *
+             *     `invalid_role` — The role belongs to another account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "team_not_in_organization" | "invalid_role" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /** @description `plan_required` — The setting requires a higher plan. `message` says which. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_required";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `role_not_found` — No role with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "role_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+            /** @description `plan_unavailable` — The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_unavailable";
+                    };
+                };
+            };
+        };
+    };
     "teammember/list": {
         parameters: {
             query?: {