@faable/auth-sdk 2.7.89 → 2.7.91

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.69.2",
+    "version": "2.73.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -536,6 +536,10 @@
             "type": "boolean",
             "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
           },
+          "client_id_metadata_documents_enabled": {
+            "type": "boolean",
+            "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+          },
           "canonical_host": {
             "type": "string",
             "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -1537,6 +1541,17 @@
           "token_endpoint_auth_method": {
             "type": "string"
           },
+          "consent_required": {
+            "type": "boolean",
+            "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+          },
+          "metadata_document_url": {
+            "type": "string",
+            "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+          },
+          "registered_dynamically": {
+            "type": "boolean"
+          },
           "application_type": {
             "type": "string"
           },
@@ -4136,6 +4151,55 @@
             "type": "boolean",
             "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
           },
+          "consent_options": {
+            "type": "object",
+            "required": [
+              "claim",
+              "label",
+              "url",
+              "audience"
+            ],
+            "properties": {
+              "claim": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                "description": "Access token claim that carries the chosen id."
+              },
+              "label": {
+                "type": "string",
+                "maxLength": 60,
+                "description": "What the screen asks for, e.g. \"Project\"."
+              },
+              "url": {
+                "type": "string",
+                "pattern": "^https://",
+                "description": "GET endpoint of the resource server that lists the choices."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+              }
+            },
+            "nullable": true
+          },
+          "delegation": {
+            "type": "object",
+            "required": [
+              "client_id",
+              "audience"
+            ],
+            "properties": {
+              "client_id": {
+                "type": "string",
+                "description": "The confidential client of the resource server allowed to exchange."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of the registered API the new token is for."
+              }
+            },
+            "nullable": true
+          },
           "skip_consent": {
             "type": "boolean",
             "description": "When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API)."
@@ -4256,6 +4320,53 @@
             "type": "boolean",
             "description": "When true, clients can request `offline_access` and receive a refresh_token for this API."
           },
+          "consent_options": {
+            "type": "object",
+            "required": [
+              "claim",
+              "label",
+              "url",
+              "audience"
+            ],
+            "properties": {
+              "claim": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                "description": "Access token claim that carries the chosen id."
+              },
+              "label": {
+                "type": "string",
+                "maxLength": 60,
+                "description": "What the screen asks for, e.g. \"Project\"."
+              },
+              "url": {
+                "type": "string",
+                "pattern": "^https://",
+                "description": "GET endpoint of the resource server that lists the choices."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+              }
+            }
+          },
+          "delegation": {
+            "type": "object",
+            "required": [
+              "client_id",
+              "audience"
+            ],
+            "properties": {
+              "client_id": {
+                "type": "string",
+                "description": "The confidential client of the resource server allowed to exchange."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of the registered API the new token is for."
+              }
+            }
+          },
           "skip_consent": {
             "type": "boolean",
             "description": "When true, skip the consent prompt for first-party clients."
@@ -4340,6 +4451,55 @@
             "type": "boolean",
             "description": "When true, clients can request `offline_access` and receive a refresh_token for this API."
           },
+          "consent_options": {
+            "type": "object",
+            "required": [
+              "claim",
+              "label",
+              "url",
+              "audience"
+            ],
+            "properties": {
+              "claim": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                "description": "Access token claim that carries the chosen id."
+              },
+              "label": {
+                "type": "string",
+                "maxLength": 60,
+                "description": "What the screen asks for, e.g. \"Project\"."
+              },
+              "url": {
+                "type": "string",
+                "pattern": "^https://",
+                "description": "GET endpoint of the resource server that lists the choices."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+              }
+            },
+            "nullable": true
+          },
+          "delegation": {
+            "type": "object",
+            "required": [
+              "client_id",
+              "audience"
+            ],
+            "properties": {
+              "client_id": {
+                "type": "string",
+                "description": "The confidential client of the resource server allowed to exchange."
+              },
+              "audience": {
+                "type": "string",
+                "description": "Identifier of the registered API the new token is for."
+              }
+            },
+            "nullable": true
+          },
           "skip_consent": {
             "type": "boolean",
             "description": "When true, skip the consent prompt for first-party clients."
@@ -6779,7 +6939,6 @@
         "type": "object",
         "required": [
           "client_id",
-          "client_secret",
           "client_id_issued_at",
           "client_secret_expires_at",
           "redirect_uris",
@@ -7523,6 +7682,10 @@
             "type": "boolean",
             "nullable": true
           },
+          "client_id_metadata_documents_enabled": {
+            "type": "boolean",
+            "nullable": true
+          },
           "canonical_host": {
             "type": "string",
             "nullable": true
@@ -7858,7 +8021,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -7978,6 +8141,8 @@
           "invite_used",
           "already_member",
           "not_a_member",
+          "consent_options_unavailable",
+          "consent_choice_invalid",
           "registration_disabled",
           "invalid_email_domain",
           "public_email_domain",
@@ -8659,6 +8824,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "client_id_metadata_documents_enabled": {
+                      "type": "boolean",
+                      "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -9407,6 +9576,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "client_id_metadata_documents_enabled": {
+                      "type": "boolean",
+                      "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -10392,6 +10565,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "client_id_metadata_documents_enabled": {
+                      "type": "boolean",
+                      "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -11021,6 +11198,10 @@
                     "type": "boolean",
                     "nullable": true
                   },
+                  "client_id_metadata_documents_enabled": {
+                    "type": "boolean",
+                    "nullable": true
+                  },
                   "canonical_host": {
                     "type": "string",
                     "nullable": true
@@ -11557,6 +11738,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "client_id_metadata_documents_enabled": {
+                      "type": "boolean",
+                      "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -12138,6 +12323,21 @@
                     "maximum": 900,
                     "default": 900,
                     "description": "Lifetime in seconds."
+                  },
+                  "scopes": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "description": "Narrow the token to these management scopes (each must be in the catalog). Omitted: the whole catalog."
+                  },
+                  "apikey_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 64,
+                    "description": "Set when the user acts through one of their deploy API keys (the hosted MCP). Recorded in the audit log and as `via_apikey` in the token."
                   }
                 },
                 "additionalProperties": false
@@ -14503,6 +14703,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "client_id_metadata_documents_enabled": {
+                      "type": "boolean",
+                      "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
+                    },
                     "canonical_host": {
                       "type": "string",
                       "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
@@ -14743,6 +14947,15 @@
             "required": false,
             "description": "Exact match on `category`. Equivalent to `?query=category:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -14796,6 +15009,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Connection"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -17866,6 +18083,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -17919,6 +18145,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Client"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -18331,6 +18561,17 @@
                     "token_endpoint_auth_method": {
                       "type": "string"
                     },
+                    "consent_required": {
+                      "type": "boolean",
+                      "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+                    },
+                    "metadata_document_url": {
+                      "type": "string",
+                      "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+                    },
+                    "registered_dynamically": {
+                      "type": "boolean"
+                    },
                     "application_type": {
                       "type": "string"
                     },
@@ -18973,6 +19214,17 @@
                     "token_endpoint_auth_method": {
                       "type": "string"
                     },
+                    "consent_required": {
+                      "type": "boolean",
+                      "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+                    },
+                    "metadata_document_url": {
+                      "type": "string",
+                      "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+                    },
+                    "registered_dynamically": {
+                      "type": "boolean"
+                    },
                     "application_type": {
                       "type": "string"
                     },
@@ -20126,6 +20378,17 @@
                     "token_endpoint_auth_method": {
                       "type": "string"
                     },
+                    "consent_required": {
+                      "type": "boolean",
+                      "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+                    },
+                    "metadata_document_url": {
+                      "type": "string",
+                      "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+                    },
+                    "registered_dynamically": {
+                      "type": "boolean"
+                    },
                     "application_type": {
                       "type": "string"
                     },
@@ -20768,6 +21031,17 @@
                     "token_endpoint_auth_method": {
                       "type": "string"
                     },
+                    "consent_required": {
+                      "type": "boolean",
+                      "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+                    },
+                    "metadata_document_url": {
+                      "type": "string",
+                      "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+                    },
+                    "registered_dynamically": {
+                      "type": "boolean"
+                    },
                     "application_type": {
                       "type": "string"
                     },
@@ -21411,6 +21685,17 @@
                     "token_endpoint_auth_method": {
                       "type": "string"
                     },
+                    "consent_required": {
+                      "type": "boolean",
+                      "description": "When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration)."
+                    },
+                    "metadata_document_url": {
+                      "type": "string",
+                      "description": "For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from."
+                    },
+                    "registered_dynamically": {
+                      "type": "boolean"
+                    },
                     "application_type": {
                       "type": "string"
                     },
@@ -22016,6 +22301,60 @@
             "required": false,
             "description": "Exact match on `suspended`. Equivalent to `?query=suspended:<value>`."
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "last_login_since",
+            "required": false,
+            "description": "Exact match on `last_login_since`. Equivalent to `?query=last_login_since:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "last_login_until",
+            "required": false,
+            "description": "Exact match on `last_login_until`. Equivalent to `?query=last_login_until:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "created_since",
+            "required": false,
+            "description": "Exact match on `created_since`. Equivalent to `?query=created_since:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "created_until",
+            "required": false,
+            "description": "Exact match on `created_until`. Equivalent to `?query=created_until:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "sort",
+            "required": false,
+            "description": "Sort by one field: `<field>` ascending, `-<field>` descending. One of: createdAt, last_login, logins_count. Rows with no value in that field are left out. Default: `-createdAt`."
+          },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -22069,6 +22408,10 @@
                       "items": {
                         "$ref": "#/components/schemas/User"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -28396,6 +28739,15 @@
             "required": false,
             "description": "Exact match on `created_at`. Equivalent to `?query=created_at:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -28456,6 +28808,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Identity"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -29757,6 +30113,15 @@
             "required": false,
             "description": "Exact match on `created_at`. Equivalent to `?query=created_at:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -29828,6 +30193,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Credential"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -31421,6 +31790,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -31474,6 +31852,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Role"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -33097,6 +33479,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -33157,6 +33548,10 @@
                       "items": {
                         "$ref": "#/components/schemas/RoleMember"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -33873,6 +34268,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -33926,6 +34330,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Team"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -35838,6 +36246,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -35891,6 +36308,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Organization"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -40005,6 +40426,15 @@
             "required": false,
             "description": "Exact match on `team`. Equivalent to `?query=team:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -40066,6 +40496,10 @@
                       "items": {
                         "$ref": "#/components/schemas/TeamMember"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -44007,6 +44441,15 @@
             "required": false,
             "description": "Exact match on `allow_offline_access`. Equivalent to `?query=allow_offline_access:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -44060,6 +44503,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Api"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -44306,6 +44753,53 @@
                     "type": "boolean",
                     "description": "When true, clients can request `offline_access` and receive a refresh_token for this API."
                   },
+                  "consent_options": {
+                    "type": "object",
+                    "required": [
+                      "claim",
+                      "label",
+                      "url",
+                      "audience"
+                    ],
+                    "properties": {
+                      "claim": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                        "description": "Access token claim that carries the chosen id."
+                      },
+                      "label": {
+                        "type": "string",
+                        "maxLength": 60,
+                        "description": "What the screen asks for, e.g. \"Project\"."
+                      },
+                      "url": {
+                        "type": "string",
+                        "pattern": "^https://",
+                        "description": "GET endpoint of the resource server that lists the choices."
+                      },
+                      "audience": {
+                        "type": "string",
+                        "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+                      }
+                    }
+                  },
+                  "delegation": {
+                    "type": "object",
+                    "required": [
+                      "client_id",
+                      "audience"
+                    ],
+                    "properties": {
+                      "client_id": {
+                        "type": "string",
+                        "description": "The confidential client of the resource server allowed to exchange."
+                      },
+                      "audience": {
+                        "type": "string",
+                        "description": "Identifier of the registered API the new token is for."
+                      }
+                    }
+                  },
                   "skip_consent": {
                     "type": "boolean",
                     "description": "When true, skip the consent prompt for first-party clients."
@@ -44437,327 +44931,54 @@
                       "type": "boolean",
                       "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
                     },
-                    "skip_consent": {
-                      "type": "boolean",
-                      "description": "When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API)."
-                    },
-                    "include_teams_in_access_token": {
-                      "type": "boolean",
-                      "description": "When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant."
-                    },
-                    "include_roles_in_access_token": {
-                      "type": "boolean",
-                      "description": "When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant."
-                    },
-                    "include_teams_in_id_token": {
-                      "type": "boolean",
-                      "description": "When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time."
-                    },
-                    "include_roles_in_id_token": {
-                      "type": "boolean",
-                      "description": "When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`."
-                    },
-                    "account": {
-                      "type": "string",
-                      "description": "Object is related with this account"
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": true,
-                      "description": "ApiMetadata",
-                      "default": {}
-                    },
-                    "createdAt": {
-                      "type": "string",
-                      "description": "Api creation date"
-                    },
-                    "updatedAt": {
-                      "type": "string",
-                      "description": "Api updated date"
-                    }
-                  },
-                  "description": "Api"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "already_exists",
-                            "validation_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "`unauthorized` — The request carries no valid credentials.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "unauthorized"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
+                    "consent_options": {
                       "type": "object",
+                      "required": [
+                        "claim",
+                        "label",
+                        "url",
+                        "audience"
+                      ],
                       "properties": {
-                        "error_code": {
+                        "claim": {
                           "type": "string",
-                          "enum": [
-                            "forbidden",
-                            "insufficient_scope",
-                            "user_suspended"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
+                          "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                          "description": "Access token claim that carries the chosen id."
+                        },
+                        "label": {
                           "type": "string",
-                          "enum": [
-                            "account_not_found"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "429": {
-            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
+                          "maxLength": 60,
+                          "description": "What the screen asks for, e.g. \"Project\"."
+                        },
+                        "url": {
                           "type": "string",
-                          "enum": [
-                            "too_many_requests"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
+                          "pattern": "^https://",
+                          "description": "GET endpoint of the resource server that lists the choices."
+                        },
+                        "audience": {
                           "type": "string",
-                          "enum": [
-                            "internal_error"
-                          ]
+                          "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
                         }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/{api_id}": {
-      "get": {
-        "operationId": "api/get",
-        "summary": "Get Api",
-        "tags": [
-          "api"
-        ],
-        "description": "Get Api",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "path",
-            "name": "api_id",
-            "required": true
-          }
-        ],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Api",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "id",
-                    "name",
-                    "slug",
-                    "identifier",
-                    "permissions",
-                    "signing_alg",
-                    "token_dialect",
-                    "token_lifetime",
-                    "enforce_policies",
-                    "allow_offline_access",
-                    "skip_consent",
-                    "include_teams_in_access_token",
-                    "include_roles_in_access_token",
-                    "include_teams_in_id_token",
-                    "include_roles_in_id_token",
-                    "account",
-                    "createdAt"
-                  ],
-                  "properties": {
-                    "id": {
-                      "type": "string",
-                      "description": "Api ID"
-                    },
-                    "name": {
-                      "type": "string",
-                      "description": "Human-readable name for the API. Shown in the dashboard and consent prompts.",
-                      "example": "My Backend API"
-                    },
-                    "slug": {
-                      "type": "string",
-                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant."
-                    },
-                    "identifier": {
-                      "type": "string",
-                      "description": "Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.",
-                      "example": "https://api.faable.com"
-                    },
-                    "description": {
-                      "type": "string",
-                      "description": "Optional human-readable description of the API."
-                    },
-                    "permissions": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/Permission"
                       },
-                      "description": "Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim."
+                      "nullable": true
                     },
-                    "signing_alg": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "RS256"
-                          ]
-                        }
+                    "delegation": {
+                      "type": "object",
+                      "required": [
+                        "client_id",
+                        "audience"
                       ],
-                      "description": "JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented."
-                    },
-                    "token_dialect": {
-                      "anyOf": [
-                        {
+                      "properties": {
+                        "client_id": {
                           "type": "string",
-                          "enum": [
-                            "access_token"
-                          ]
+                          "description": "The confidential client of the resource server allowed to exchange."
                         },
-                        {
+                        "audience": {
                           "type": "string",
-                          "enum": [
-                            "access_token_authz"
-                          ]
+                          "description": "Identifier of the registered API the new token is for."
                         }
-                      ],
-                      "description": "Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API."
-                    },
-                    "token_lifetime": {
-                      "type": "integer",
-                      "description": "Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default).",
-                      "minimum": 60,
-                      "maximum": 2592000
-                    },
-                    "enforce_policies": {
-                      "type": "boolean",
-                      "description": "When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering."
-                    },
-                    "allow_offline_access": {
-                      "type": "boolean",
-                      "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
+                      },
+                      "nullable": true
                     },
                     "skip_consent": {
                       "type": "boolean",
@@ -44805,7 +45026,7 @@
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -44819,8 +45040,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
-                            "invalid_expand",
+                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -44884,7 +45104,7 @@
             }
           },
           "404": {
-            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -44898,7 +45118,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "not_found",
                             "account_not_found"
                           ]
                         }
@@ -44960,106 +45179,16 @@
             }
           }
         }
-      },
-      "post": {
-        "operationId": "api/update",
-        "summary": "Update Api",
+      }
+    },
+    "/api/{api_id}": {
+      "get": {
+        "operationId": "api/get",
+        "summary": "Get Api",
         "tags": [
           "api"
         ],
-        "description": "Update Api",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "description": "Human-readable name for the API."
-                  },
-                  "description": {
-                    "type": "string",
-                    "description": "Optional human-readable description of the API."
-                  },
-                  "permissions": {
-                    "type": "array",
-                    "items": {
-                      "$ref": "#/components/schemas/PermissionCreate"
-                    },
-                    "description": "Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged."
-                  },
-                  "signing_alg": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "RS256"
-                        ]
-                      }
-                    ],
-                    "description": "JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented."
-                  },
-                  "token_dialect": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "access_token"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "access_token_authz"
-                        ]
-                      }
-                    ],
-                    "description": "Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API."
-                  },
-                  "token_lifetime": {
-                    "type": "integer",
-                    "description": "Access_token lifetime in seconds.",
-                    "minimum": 60,
-                    "maximum": 2592000
-                  },
-                  "enforce_policies": {
-                    "type": "boolean",
-                    "description": "When true, requested scopes are filtered against `permissions` at token issuance."
-                  },
-                  "allow_offline_access": {
-                    "type": "boolean",
-                    "description": "When true, clients can request `offline_access` and receive a refresh_token for this API."
-                  },
-                  "skip_consent": {
-                    "type": "boolean",
-                    "description": "When true, skip the consent prompt for first-party clients."
-                  },
-                  "include_teams_in_access_token": {
-                    "type": "boolean",
-                    "description": "When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs."
-                  },
-                  "include_roles_in_access_token": {
-                    "type": "boolean",
-                    "description": "When true, access_tokens issued for this API carry a `roles` claim with the subject role names."
-                  },
-                  "include_teams_in_id_token": {
-                    "type": "boolean",
-                    "description": "When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs."
-                  },
-                  "include_roles_in_id_token": {
-                    "type": "boolean",
-                    "description": "When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names."
-                  }
-                },
-                "additionalProperties": false,
-                "description": "Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it."
-              }
-            }
-          },
-          "description": "Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it."
-        },
+        "description": "Get Api",
         "parameters": [
           {
             "schema": {
@@ -45173,6 +45302,55 @@
                       "type": "boolean",
                       "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
                     },
+                    "consent_options": {
+                      "type": "object",
+                      "required": [
+                        "claim",
+                        "label",
+                        "url",
+                        "audience"
+                      ],
+                      "properties": {
+                        "claim": {
+                          "type": "string",
+                          "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                          "description": "Access token claim that carries the chosen id."
+                        },
+                        "label": {
+                          "type": "string",
+                          "maxLength": 60,
+                          "description": "What the screen asks for, e.g. \"Project\"."
+                        },
+                        "url": {
+                          "type": "string",
+                          "pattern": "^https://",
+                          "description": "GET endpoint of the resource server that lists the choices."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "delegation": {
+                      "type": "object",
+                      "required": [
+                        "client_id",
+                        "audience"
+                      ],
+                      "properties": {
+                        "client_id": {
+                          "type": "string",
+                          "description": "The confidential client of the resource server allowed to exchange."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of the registered API the new token is for."
+                        }
+                      },
+                      "nullable": true
+                    },
                     "skip_consent": {
                       "type": "boolean",
                       "description": "When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API)."
@@ -45219,7 +45397,7 @@
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -45234,7 +45412,7 @@
                           "type": "string",
                           "enum": [
                             "invalid_id",
-                            "already_exists",
+                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -45375,13 +45553,154 @@
           }
         }
       },
-      "delete": {
-        "operationId": "api/delete",
-        "summary": "Delete Api",
+      "post": {
+        "operationId": "api/update",
+        "summary": "Update Api",
         "tags": [
           "api"
         ],
-        "description": "Delete Api",
+        "description": "Update Api",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "Human-readable name for the API."
+                  },
+                  "description": {
+                    "type": "string",
+                    "description": "Optional human-readable description of the API."
+                  },
+                  "permissions": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/PermissionCreate"
+                    },
+                    "description": "Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged."
+                  },
+                  "signing_alg": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "RS256"
+                        ]
+                      }
+                    ],
+                    "description": "JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented."
+                  },
+                  "token_dialect": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "access_token"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "access_token_authz"
+                        ]
+                      }
+                    ],
+                    "description": "Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API."
+                  },
+                  "token_lifetime": {
+                    "type": "integer",
+                    "description": "Access_token lifetime in seconds.",
+                    "minimum": 60,
+                    "maximum": 2592000
+                  },
+                  "enforce_policies": {
+                    "type": "boolean",
+                    "description": "When true, requested scopes are filtered against `permissions` at token issuance."
+                  },
+                  "allow_offline_access": {
+                    "type": "boolean",
+                    "description": "When true, clients can request `offline_access` and receive a refresh_token for this API."
+                  },
+                  "consent_options": {
+                    "type": "object",
+                    "required": [
+                      "claim",
+                      "label",
+                      "url",
+                      "audience"
+                    ],
+                    "properties": {
+                      "claim": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                        "description": "Access token claim that carries the chosen id."
+                      },
+                      "label": {
+                        "type": "string",
+                        "maxLength": 60,
+                        "description": "What the screen asks for, e.g. \"Project\"."
+                      },
+                      "url": {
+                        "type": "string",
+                        "pattern": "^https://",
+                        "description": "GET endpoint of the resource server that lists the choices."
+                      },
+                      "audience": {
+                        "type": "string",
+                        "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+                      }
+                    },
+                    "nullable": true
+                  },
+                  "delegation": {
+                    "type": "object",
+                    "required": [
+                      "client_id",
+                      "audience"
+                    ],
+                    "properties": {
+                      "client_id": {
+                        "type": "string",
+                        "description": "The confidential client of the resource server allowed to exchange."
+                      },
+                      "audience": {
+                        "type": "string",
+                        "description": "Identifier of the registered API the new token is for."
+                      }
+                    },
+                    "nullable": true
+                  },
+                  "skip_consent": {
+                    "type": "boolean",
+                    "description": "When true, skip the consent prompt for first-party clients."
+                  },
+                  "include_teams_in_access_token": {
+                    "type": "boolean",
+                    "description": "When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs."
+                  },
+                  "include_roles_in_access_token": {
+                    "type": "boolean",
+                    "description": "When true, access_tokens issued for this API carry a `roles` claim with the subject role names."
+                  },
+                  "include_teams_in_id_token": {
+                    "type": "boolean",
+                    "description": "When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs."
+                  },
+                  "include_roles_in_id_token": {
+                    "type": "boolean",
+                    "description": "When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names."
+                  }
+                },
+                "additionalProperties": false,
+                "description": "Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it."
+              }
+            }
+          },
+          "description": "Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it."
+        },
         "parameters": [
           {
             "schema": {
@@ -45495,6 +45814,426 @@
                       "type": "boolean",
                       "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
                     },
+                    "consent_options": {
+                      "type": "object",
+                      "required": [
+                        "claim",
+                        "label",
+                        "url",
+                        "audience"
+                      ],
+                      "properties": {
+                        "claim": {
+                          "type": "string",
+                          "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                          "description": "Access token claim that carries the chosen id."
+                        },
+                        "label": {
+                          "type": "string",
+                          "maxLength": 60,
+                          "description": "What the screen asks for, e.g. \"Project\"."
+                        },
+                        "url": {
+                          "type": "string",
+                          "pattern": "^https://",
+                          "description": "GET endpoint of the resource server that lists the choices."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "delegation": {
+                      "type": "object",
+                      "required": [
+                        "client_id",
+                        "audience"
+                      ],
+                      "properties": {
+                        "client_id": {
+                          "type": "string",
+                          "description": "The confidential client of the resource server allowed to exchange."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of the registered API the new token is for."
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "skip_consent": {
+                      "type": "boolean",
+                      "description": "When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API)."
+                    },
+                    "include_teams_in_access_token": {
+                      "type": "boolean",
+                      "description": "When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant."
+                    },
+                    "include_roles_in_access_token": {
+                      "type": "boolean",
+                      "description": "When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant."
+                    },
+                    "include_teams_in_id_token": {
+                      "type": "boolean",
+                      "description": "When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time."
+                    },
+                    "include_roles_in_id_token": {
+                      "type": "boolean",
+                      "description": "When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "ApiMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Api creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Api updated date"
+                    }
+                  },
+                  "description": "Api"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "already_exists",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "api/delete",
+        "summary": "Delete Api",
+        "tags": [
+          "api"
+        ],
+        "description": "Delete Api",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "api_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Api",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "slug",
+                    "identifier",
+                    "permissions",
+                    "signing_alg",
+                    "token_dialect",
+                    "token_lifetime",
+                    "enforce_policies",
+                    "allow_offline_access",
+                    "skip_consent",
+                    "include_teams_in_access_token",
+                    "include_roles_in_access_token",
+                    "include_teams_in_id_token",
+                    "include_roles_in_id_token",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Api ID"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "Human-readable name for the API. Shown in the dashboard and consent prompts.",
+                      "example": "My Backend API"
+                    },
+                    "slug": {
+                      "type": "string",
+                      "description": "URL-safe identifier auto-derived from `name`. Unique within the tenant."
+                    },
+                    "identifier": {
+                      "type": "string",
+                      "description": "Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.",
+                      "example": "https://api.faable.com"
+                    },
+                    "description": {
+                      "type": "string",
+                      "description": "Optional human-readable description of the API."
+                    },
+                    "permissions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Permission"
+                      },
+                      "description": "Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim."
+                    },
+                    "signing_alg": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "RS256"
+                          ]
+                        }
+                      ],
+                      "description": "JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented."
+                    },
+                    "token_dialect": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "access_token"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "access_token_authz"
+                          ]
+                        }
+                      ],
+                      "description": "Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API."
+                    },
+                    "token_lifetime": {
+                      "type": "integer",
+                      "description": "Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default).",
+                      "minimum": 60,
+                      "maximum": 2592000
+                    },
+                    "enforce_policies": {
+                      "type": "boolean",
+                      "description": "When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering."
+                    },
+                    "allow_offline_access": {
+                      "type": "boolean",
+                      "description": "When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it)."
+                    },
+                    "consent_options": {
+                      "type": "object",
+                      "required": [
+                        "claim",
+                        "label",
+                        "url",
+                        "audience"
+                      ],
+                      "properties": {
+                        "claim": {
+                          "type": "string",
+                          "pattern": "^[a-z][a-z0-9_]{0,31}$",
+                          "description": "Access token claim that carries the chosen id."
+                        },
+                        "label": {
+                          "type": "string",
+                          "maxLength": 60,
+                          "description": "What the screen asks for, e.g. \"Project\"."
+                        },
+                        "url": {
+                          "type": "string",
+                          "pattern": "^https://",
+                          "description": "GET endpoint of the resource server that lists the choices."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of a registered API the listing token is issued for (usually the resource server behind `url`)."
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "delegation": {
+                      "type": "object",
+                      "required": [
+                        "client_id",
+                        "audience"
+                      ],
+                      "properties": {
+                        "client_id": {
+                          "type": "string",
+                          "description": "The confidential client of the resource server allowed to exchange."
+                        },
+                        "audience": {
+                          "type": "string",
+                          "description": "Identifier of the registered API the new token is for."
+                        }
+                      },
+                      "nullable": true
+                    },
                     "skip_consent": {
                       "type": "boolean",
                       "description": "When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API)."
@@ -46136,6 +46875,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -46178,6 +46926,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Action"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -50884,6 +51636,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -50926,6 +51687,10 @@
                       "items": {
                         "$ref": "#/components/schemas/LoginFlow"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -54559,6 +55324,15 @@
             "required": false,
             "description": "Exact match on `events`. Equivalent to `?query=events:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -54601,6 +55375,10 @@
                       "items": {
                         "$ref": "#/components/schemas/NotificationSubscription"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -57311,252 +58089,265 @@
           },
           {
             "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "query",
-            "required": false,
-            "description": "Filter using a FaableQL query"
-          },
-          {
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "enum": [
-                  "user",
-                  "client",
-                  "connection",
-                  "team",
-                  "identity"
-                ],
-                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
-              },
-              "maxItems": 5
+              "type": "boolean"
             },
             "in": "query",
-            "name": "expand",
+            "name": "count",
             "required": false,
-            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
           },
           {
             "schema": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 200
+              "type": "string"
             },
             "in": "query",
-            "name": "q",
+            "name": "query",
             "required": false,
-            "description": "Full-text search across: `message`."
-          }
-        ],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Default Response",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "next",
-                    "results"
-                  ],
-                  "properties": {
-                    "next": {
-                      "anyOf": [
-                        {
-                          "type": "string"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "results": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/Log"
-                      }
-                    }
-                  },
-                  "additionalProperties": false
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "invalid_query",
-                            "invalid_expand",
-                            "search_not_supported",
-                            "validation_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "`unauthorized` — The request carries no valid credentials.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "unauthorized"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "forbidden",
-                            "insufficient_scope",
-                            "user_suspended"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "account_not_found"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "429": {
-            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "too_many_requests"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
+            "description": "Filter using a FaableQL query"
           },
-          "500": {
-            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "internal_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/log/{log_id}": {
-      "get": {
-        "operationId": "log/get",
-        "summary": "Get Log",
-        "tags": [
-          "log"
-        ],
-        "description": "Get Log",
-        "parameters": [
+          {
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "user",
+                  "client",
+                  "connection",
+                  "team",
+                  "identity"
+                ],
+                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
+              },
+              "maxItems": 5
+            },
+            "in": "query",
+            "name": "expand",
+            "required": false,
+            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `message`."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "next",
+                    "results"
+                  ],
+                  "properties": {
+                    "next": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Log"
+                      }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_query",
+                            "invalid_expand",
+                            "search_not_supported",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/log/{log_id}": {
+      "get": {
+        "operationId": "log/get",
+        "summary": "Get Log",
+        "tags": [
+          "log"
+        ],
+        "description": "Get Log",
+        "parameters": [
           {
             "schema": {
               "type": "array",
@@ -57998,6 +58789,15 @@
             "required": false,
             "description": "Exact match on `until`. Equivalent to `?query=until:<value>`."
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -58059,6 +58859,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Session"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -59156,6 +59960,15 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
+          {
+            "schema": {
+              "type": "boolean"
+            },
+            "in": "query",
+            "name": "count",
+            "required": false,
+            "description": "Also return `total`: the rows matching the whole filter, across every page."
+          },
           {
             "schema": {
               "type": "string"
@@ -59209,6 +60022,10 @@
                       "items": {
                         "$ref": "#/components/schemas/Customdomain"
                       }
+                    },
+                    "total": {
+                      "type": "integer",
+                      "description": "Rows matching the whole filter, across every page. Only with `?count=true`."
                     }
                   },
                   "additionalProperties": false
@@ -64417,6 +65234,341 @@
         }
       }
     },
+    "/me/grants": {
+      "get": {
+        "summary": "Apps the signed-in user has connected",
+        "tags": [
+          "account"
+        ],
+        "description": "The live grants of the session user: each app they allowed on the consent screen, what it can do and what they picked (e.g. the project).",
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "id",
+                          "client",
+                          "resource",
+                          "scopes",
+                          "created_at"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string"
+                          },
+                          "client": {
+                            "type": "object",
+                            "required": [
+                              "name"
+                            ],
+                            "properties": {
+                              "name": {
+                                "type": "string"
+                              },
+                              "logo_uri": {
+                                "type": "string"
+                              },
+                              "client_uri": {
+                                "type": "string"
+                              },
+                              "metadata_document_url": {
+                                "type": "string"
+                              }
+                            }
+                          },
+                          "resource": {
+                            "type": "string"
+                          },
+                          "scopes": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          },
+                          "options": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          },
+                          "created_at": {
+                            "type": "string"
+                          },
+                          "last_used_at": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/me/grants/{grant_id}": {
+      "delete": {
+        "summary": "Disconnect an app",
+        "tags": [
+          "account"
+        ],
+        "description": "Revokes one of the session user’s grants. The app loses access at its next token refresh (within an hour), and has to ask again to reconnect.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "grant_id",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "400": {
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/me": {
       "get": {
         "operationId": "session/me",
@@ -67432,6 +68584,9 @@
                     },
                     "scope": {
                       "type": "string"
+                    },
+                    "issued_token_type": {
+                      "type": "string"
                     }
                   }
                 }
@@ -67927,6 +69082,9 @@
                     },
                     "scope": {
                       "type": "string"
+                    },
+                    "issued_token_type": {
+                      "type": "string"
                     }
                   }
                 }
@@ -69292,6 +70450,71 @@
         }
       }
     },
+    "/.well-known/oauth-authorization-server": {
+      "get": {
+        "operationId": "oauth/authorizationServerMetadata",
+        "summary": "OAuth 2.0 Authorization Server Metadata (RFC 8414)",
+        "tags": [
+          "oauth"
+        ],
+        "description": "The same provider metadata as the OpenID Connect Discovery document, at the RFC 8414 location that OAuth 2.0 and MCP clients query.",
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/.well-known/jwks.json": {
       "get": {
         "operationId": "oauth/jwks",
@@ -69790,7 +71013,6 @@
                   "type": "object",
                   "required": [
                     "client_id",
-                    "client_secret",
                     "client_id_issued_at",
                     "client_secret_expires_at",
                     "redirect_uris",
@@ -70027,6 +71249,669 @@
         }
       }
     },
+    "/consent/context": {
+      "get": {
+        "summary": "What the consent screen shows",
+        "tags": [
+          "oauth"
+        ],
+        "description": "For a login parked on the consent screen: the client asking (name, logo, where it redirects), the user, the API and permissions requested, and — when the API offers one — the choice the user has to make (e.g. which project).",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "state",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "account",
+                    "client",
+                    "user",
+                    "scopes"
+                  ],
+                  "properties": {
+                    "account": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string"
+                        }
+                      }
+                    },
+                    "client": {
+                      "type": "object",
+                      "required": [
+                        "name",
+                        "localhost_only"
+                      ],
+                      "properties": {
+                        "name": {
+                          "type": "string"
+                        },
+                        "logo_uri": {
+                          "type": "string"
+                        },
+                        "client_uri": {
+                          "type": "string"
+                        },
+                        "redirect_host": {
+                          "type": "string"
+                        },
+                        "localhost_only": {
+                          "type": "boolean"
+                        },
+                        "metadata_document_url": {
+                          "type": "string"
+                        }
+                      }
+                    },
+                    "user": {
+                      "type": "object",
+                      "properties": {
+                        "email": {
+                          "type": "string"
+                        },
+                        "name": {
+                          "type": "string"
+                        }
+                      }
+                    },
+                    "resource": {
+                      "type": "object",
+                      "required": [
+                        "identifier",
+                        "name"
+                      ],
+                      "properties": {
+                        "identifier": {
+                          "type": "string"
+                        },
+                        "name": {
+                          "type": "string"
+                        }
+                      }
+                    },
+                    "scopes": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "value",
+                          "description"
+                        ],
+                        "properties": {
+                          "value": {
+                            "type": "string"
+                          },
+                          "description": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
+                    "choice": {
+                      "type": "object",
+                      "required": [
+                        "label",
+                        "options"
+                      ],
+                      "properties": {
+                        "label": {
+                          "type": "string"
+                        },
+                        "options": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "required": [
+                              "id",
+                              "name"
+                            ],
+                            "properties": {
+                              "id": {
+                                "type": "string"
+                              },
+                              "name": {
+                                "type": "string"
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_state",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`state_mismatch` — The `state` belongs to another account, session, client or ceremony.\n\n`session_missing` — The session that started this login no longer exists.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "state_mismatch",
+                            "session_missing"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "502": {
+            "description": "`consent_options_unavailable` — The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "consent_options_unavailable"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/consent": {
+      "post": {
+        "summary": "Allow or deny a client on the consent screen",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Records the decision and returns where the browser goes next: on `allow`, on to the client with its code (the grant is remembered, so the screen is not shown again for the same permissions); on `deny`, back to the client with `error=access_denied`. `choice` is required when the consent context offered one, and must be one of its options.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "state",
+                  "decision"
+                ],
+                "properties": {
+                  "state": {
+                    "type": "string"
+                  },
+                  "decision": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "allow"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "deny"
+                        ]
+                      }
+                    ]
+                  },
+                  "choice": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "redirect_url"
+                  ],
+                  "properties": {
+                    "redirect_url": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`consent_choice_invalid` — The choice sent with the consent decision is not one the API offered for this user.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_state",
+                            "consent_choice_invalid",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`state_mismatch` — The `state` belongs to another account, session, client or ceremony.\n\n`session_missing` — The session that started this login no longer exists.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "state_mismatch",
+                            "session_missing"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "502": {
+            "description": "`consent_options_unavailable` — The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "consent_options_unavailable"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/revoke": {
+      "post": {
+        "operationId": "oauth/revoke",
+        "summary": "Revoke a token (RFC 7009)",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Revokes a refresh token (and, for a client the End-User had to allow, the grant behind it). Access tokens are short-lived and not revocable; the response is 200 either way, also for an unknown token. The client authenticates as at the token endpoint: `client_secret_basic`, `client_secret_post`, or just `client_id` for a public client.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "token"
+                ],
+                "properties": {
+                  "token": {
+                    "type": "string"
+                  },
+                  "token_type_hint": {
+                    "type": "string"
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "client_secret": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "400": {
+            "description": "`invalid_client` — The `client_id` in the request does not name a client of this account.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_client",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/usernamepassword/login": {
       "post": {
         "operationId": "usernamepassword/login",