@faable/auth-sdk 2.7.90 → 2.7.92

package/dist/api/types.d.ts

@@ -4242,6 +4242,213 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/me/grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Apps the signed-in user has connected
+         * @description The live grants of the session user: each app they allowed on the consent screen, what it can do and what they picked (e.g. the project).
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            data: {
+                                id: string;
+                                client: {
+                                    name: string;
+                                    logo_uri?: string;
+                                    client_uri?: string;
+                                    metadata_document_url?: string;
+                                };
+                                resource: string;
+                                scopes: string[];
+                                options?: {
+                                    [key: string]: string;
+                                };
+                                created_at: string;
+                                last_used_at?: string;
+                            }[];
+                        };
+                    };
+                };
+                /** @description `not_logged_in` — There is no signed-in session for this request. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "not_logged_in";
+                        };
+                    };
+                };
+                /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "account_not_found";
+                        };
+                    };
+                };
+                /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+                429: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "too_many_requests";
+                        };
+                    };
+                };
+                /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "internal_error";
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/grants/{grant_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Disconnect an app
+         * @description Revokes one of the session user’s grants. The app loses access at its next token refresh (within an hour), and has to ask again to reconnect.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    grant_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "validation_error";
+                        };
+                    };
+                };
+                /** @description `not_logged_in` — There is no signed-in session for this request. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "not_logged_in";
+                        };
+                    };
+                };
+                /**
+                 * @description `not_found` — The resource does not exist in this account.
+                 *
+                 *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+                 */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "not_found" | "account_not_found";
+                        };
+                    };
+                };
+                /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+                429: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "too_many_requests";
+                        };
+                    };
+                };
+                /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "internal_error";
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/me": {
         parameters: {
             query?: never;
@@ -4614,6 +4821,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/.well-known/oauth-authorization-server": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * OAuth 2.0 Authorization Server Metadata (RFC 8414)
+         * @description The same provider metadata as the OpenID Connect Discovery document, at the RFC 8414 location that OAuth 2.0 and MCP clients query.
+         */
+        get: operations["oauth/authorizationServerMetadata"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/.well-known/jwks.json": {
         parameters: {
             query?: never;
@@ -4641,24 +4868,327 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /**
-         * OpenID Connect UserInfo endpoint
-         * @description Returns claims about the authenticated User. Authentication is via a Bearer access token (RFC 6750). Returned claims are filtered by the `scope` claim of the access token (OIDC §5.3.2). The response always contains `sub`. See https://openid.net/specs/openid-connect-core-1_0.html#UserInfo.
-         */
-        get: operations["oauth/userinfo"];
-        put?: never;
-        /**
-         * OpenID Connect UserInfo endpoint (POST)
-         * @description Same as `GET /userinfo`. Provided for clients that prefer to send the Bearer token in a POST body or are required to by spec compliance audits.
-         */
-        post: operations["oauth/userinfoPost"];
+        /**
+         * OpenID Connect UserInfo endpoint
+         * @description Returns claims about the authenticated User. Authentication is via a Bearer access token (RFC 6750). Returned claims are filtered by the `scope` claim of the access token (OIDC §5.3.2). The response always contains `sub`. See https://openid.net/specs/openid-connect-core-1_0.html#UserInfo.
+         */
+        get: operations["oauth/userinfo"];
+        put?: never;
+        /**
+         * OpenID Connect UserInfo endpoint (POST)
+         * @description Same as `GET /userinfo`. Provided for clients that prefer to send the Bearer token in a POST body or are required to by spec compliance audits.
+         */
+        post: operations["oauth/userinfoPost"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/oidc/register": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * OpenID Connect Dynamic Client Registration
+         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context. Only when the tenant has `dynamic_client_registration_enabled`; otherwise `registration_disabled` (403).
+         */
+        post: operations["oauth/register"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/consent/context": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What the consent screen shows
+         * @description For a login parked on the consent screen: the client asking (name, logo, where it redirects), the user, the API and permissions requested, and — when the API offers one — the choice the user has to make (e.g. which project).
+         */
+        get: {
+            parameters: {
+                query: {
+                    state: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            account: {
+                                name?: string;
+                            };
+                            client: {
+                                name: string;
+                                logo_uri?: string;
+                                client_uri?: string;
+                                redirect_host?: string;
+                                localhost_only: boolean;
+                                metadata_document_url?: string;
+                            };
+                            user: {
+                                email?: string;
+                                name?: string;
+                            };
+                            resource?: {
+                                identifier: string;
+                                name: string;
+                            };
+                            scopes: {
+                                value: string;
+                                description: string;
+                            }[];
+                            choice?: {
+                                label: string;
+                                options: {
+                                    id: string;
+                                    name: string;
+                                }[];
+                            };
+                        };
+                    };
+                };
+                /**
+                 * @description `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+                 *
+                 *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+                 */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "invalid_state" | "validation_error";
+                        };
+                    };
+                };
+                /**
+                 * @description `state_mismatch` — The `state` belongs to another account, session, client or ceremony.
+                 *
+                 *     `session_missing` — The session that started this login no longer exists.
+                 */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "state_mismatch" | "session_missing";
+                        };
+                    };
+                };
+                /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "account_not_found";
+                        };
+                    };
+                };
+                /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+                429: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "too_many_requests";
+                        };
+                    };
+                };
+                /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "internal_error";
+                        };
+                    };
+                };
+                /** @description `consent_options_unavailable` — The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "consent_options_unavailable";
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/consent": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Allow or deny a client on the consent screen
+         * @description Records the decision and returns where the browser goes next: on `allow`, on to the client with its code (the grant is remembered, so the screen is not shown again for the same permissions); on `deny`, back to the client with `error=access_denied`. `choice` is required when the consent context offered one, and must be one of its options.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                        decision: "allow" | "deny";
+                        choice?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+                /**
+                 * @description `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+                 *
+                 *     `consent_choice_invalid` — The choice sent with the consent decision is not one the API offered for this user.
+                 *
+                 *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+                 */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "invalid_state" | "consent_choice_invalid" | "validation_error";
+                        };
+                    };
+                };
+                /**
+                 * @description `state_mismatch` — The `state` belongs to another account, session, client or ceremony.
+                 *
+                 *     `session_missing` — The session that started this login no longer exists.
+                 */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "state_mismatch" | "session_missing";
+                        };
+                    };
+                };
+                /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "account_not_found";
+                        };
+                    };
+                };
+                /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+                429: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "too_many_requests";
+                        };
+                    };
+                };
+                /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "internal_error";
+                        };
+                    };
+                };
+                /** @description `consent_options_unavailable` — The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"] & {
+                            /** @enum {string} */
+                            error_code?: "consent_options_unavailable";
+                        };
+                    };
+                };
+            };
+        };
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/oidc/register": {
+    "/oauth/revoke": {
         parameters: {
             query?: never;
             header?: never;
@@ -4668,10 +5198,10 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * OpenID Connect Dynamic Client Registration
-         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context. Only when the tenant has `dynamic_client_registration_enabled`; otherwise `registration_disabled` (403).
+         * Revoke a token (RFC 7009)
+         * @description Revokes a refresh token (and, for a client the End-User had to allow, the grant behind it). Access tokens are short-lived and not revocable; the response is 200 either way, also for an unknown token. The client authenticates as at the token endpoint: `client_secret_basic`, `client_secret_post`, or just `client_id` for a public client.
          */
-        post: operations["oauth/register"];
+        post: operations["oauth/revoke"];
         delete?: never;
         options?: never;
         head?: never;
@@ -4959,6 +5489,8 @@ export interface components {
             logout_confirm_required?: boolean;
             /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
             dynamic_client_registration_enabled?: boolean;
+            /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+            client_id_metadata_documents_enabled?: boolean;
             /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
             canonical_host?: string | null;
             /** @description AuthAccount creation date */
@@ -5227,6 +5759,11 @@ export interface components {
             grant_types?: string[];
             response_types?: string[];
             token_endpoint_auth_method?: string;
+            /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+            consent_required?: boolean;
+            /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+            metadata_document_url?: string;
+            registered_dynamically?: boolean;
             application_type?: string;
             software_id?: string | null;
             software_version?: string | null;
@@ -6092,6 +6629,24 @@ export interface components {
             enforce_policies: boolean;
             /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
             allow_offline_access: boolean;
+            consent_options?: {
+                /** @description Access token claim that carries the chosen id. */
+                claim: string;
+                /** @description What the screen asks for, e.g. "Project". */
+                label: string;
+                /** @description GET endpoint of the resource server that lists the choices. */
+                url: string;
+                /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                audience: string;
+                /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                scope?: string;
+            } | null;
+            delegation?: {
+                /** @description The confidential client of the resource server allowed to exchange. */
+                client_id: string;
+                /** @description Identifier of the registered API the new token is for. */
+                audience: string;
+            } | null;
             /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
             skip_consent: boolean;
             /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
@@ -6152,6 +6707,24 @@ export interface components {
             enforce_policies?: boolean;
             /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
             allow_offline_access?: boolean;
+            consent_options?: {
+                /** @description Access token claim that carries the chosen id. */
+                claim: string;
+                /** @description What the screen asks for, e.g. "Project". */
+                label: string;
+                /** @description GET endpoint of the resource server that lists the choices. */
+                url: string;
+                /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                audience: string;
+                /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                scope?: string;
+            };
+            delegation?: {
+                /** @description The confidential client of the resource server allowed to exchange. */
+                client_id: string;
+                /** @description Identifier of the registered API the new token is for. */
+                audience: string;
+            };
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
             /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
@@ -6181,6 +6754,24 @@ export interface components {
             enforce_policies?: boolean;
             /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
             allow_offline_access?: boolean;
+            consent_options?: {
+                /** @description Access token claim that carries the chosen id. */
+                claim: string;
+                /** @description What the screen asks for, e.g. "Project". */
+                label: string;
+                /** @description GET endpoint of the resource server that lists the choices. */
+                url: string;
+                /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                audience: string;
+                /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                scope?: string;
+            } | null;
+            delegation?: {
+                /** @description The confidential client of the resource server allowed to exchange. */
+                client_id: string;
+                /** @description Identifier of the registered API the new token is for. */
+                audience: string;
+            } | null;
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
             /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
@@ -7019,7 +7610,7 @@ export interface components {
         };
         ClientRegistrationResponse: {
             client_id: string;
-            client_secret: string;
+            client_secret?: string;
             /** @description Unix timestamp (seconds) at which the client_id was issued */
             client_id_issued_at: number;
             /** @description 0 if the client_secret does not expire */
@@ -7193,6 +7784,7 @@ export interface components {
             webauthn_rp_id?: string | null;
             logout_confirm_required?: boolean | null;
             dynamic_client_registration_enabled?: boolean | null;
+            client_id_metadata_documents_enabled?: boolean | null;
             canonical_host?: string | null;
             login_flow?: string | null;
         };
@@ -7403,6 +7995,8 @@ export interface components {
          *     - `invite_used` (400): The invite was already accepted.
          *     - `already_member` (400): The user is already a member of the team.
          *     - `not_a_member` (404): The user is not a member of the team.
+         *     - `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.
+         *     - `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.
          *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
          *     - `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
          *     - `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
@@ -7430,7 +8024,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -7592,6 +8186,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+                        client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7949,6 +8545,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+                        client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -8194,6 +8792,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+                        client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -8387,6 +8987,7 @@ export interface operations {
                     webauthn_rp_id?: string | null;
                     logout_confirm_required?: boolean | null;
                     dynamic_client_registration_enabled?: boolean | null;
+                    client_id_metadata_documents_enabled?: boolean | null;
                     canonical_host?: string | null;
                     login_flow?: string | null;
                 };
@@ -8515,6 +9116,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+                        client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -8828,6 +9431,10 @@ export interface operations {
                      * @default 900
                      */
                     ttl?: number;
+                    /** @description Narrow the token to these management scopes (each must be in the catalog). Omitted: the whole catalog. */
+                    scopes?: string[];
+                    /** @description Set when the user acts through one of their deploy API keys (the hosted MCP). Recorded in the audit log and as `via_apikey` in the token. */
+                    apikey_id?: string;
                 };
             };
         };
@@ -9779,6 +10386,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
+                        client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -9887,6 +10496,8 @@ export interface operations {
                 enabled?: string;
                 /** @description Exact match on `category`. Equivalent to `?query=category:<value>`. */
                 category?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `connection_name`, `connection_type`. */
@@ -9907,6 +10518,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Connection"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -11153,6 +11766,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`, `client_id`. */
@@ -11173,6 +11788,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Client"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -11324,6 +11941,11 @@ export interface operations {
                         grant_types?: string[];
                         response_types?: string[];
                         token_endpoint_auth_method?: string;
+                        /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+                        consent_required?: boolean;
+                        /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+                        metadata_document_url?: string;
+                        registered_dynamically?: boolean;
                         application_type?: string;
                         software_id?: string | null;
                         software_version?: string | null;
@@ -11524,6 +12146,11 @@ export interface operations {
                         grant_types?: string[];
                         response_types?: string[];
                         token_endpoint_auth_method?: string;
+                        /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+                        consent_required?: boolean;
+                        /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+                        metadata_document_url?: string;
+                        registered_dynamically?: boolean;
                         application_type?: string;
                         software_id?: string | null;
                         software_version?: string | null;
@@ -11819,6 +12446,11 @@ export interface operations {
                         grant_types?: string[];
                         response_types?: string[];
                         token_endpoint_auth_method?: string;
+                        /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+                        consent_required?: boolean;
+                        /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+                        metadata_document_url?: string;
+                        registered_dynamically?: boolean;
                         application_type?: string;
                         software_id?: string | null;
                         software_version?: string | null;
@@ -12025,6 +12657,11 @@ export interface operations {
                         grant_types?: string[];
                         response_types?: string[];
                         token_endpoint_auth_method?: string;
+                        /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+                        consent_required?: boolean;
+                        /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+                        metadata_document_url?: string;
+                        registered_dynamically?: boolean;
                         application_type?: string;
                         software_id?: string | null;
                         software_version?: string | null;
@@ -12229,6 +12866,11 @@ export interface operations {
                         grant_types?: string[];
                         response_types?: string[];
                         token_endpoint_auth_method?: string;
+                        /** @description When true, /authorize never issues a code in silence for this client: the End-User approves it on the consent screen first. Set on clients the tenant did not create (Client ID Metadata Documents, dynamic registration). */
+                        consent_required?: boolean;
+                        /** @description For a client identified by a Client ID Metadata Document: the URL (also its client_id) its metadata was fetched from. */
+                        metadata_document_url?: string;
+                        registered_dynamically?: boolean;
                         application_type?: string;
                         software_id?: string | null;
                         software_version?: string | null;
@@ -12412,6 +13054,18 @@ export interface operations {
                 email_verified?: string;
                 /** @description Exact match on `suspended`. Equivalent to `?query=suspended:<value>`. */
                 suspended?: string;
+                /** @description Exact match on `last_login_since`. Equivalent to `?query=last_login_since:<value>`. */
+                last_login_since?: string;
+                /** @description Exact match on `last_login_until`. Equivalent to `?query=last_login_until:<value>`. */
+                last_login_until?: string;
+                /** @description Exact match on `created_since`. Equivalent to `?query=created_since:<value>`. */
+                created_since?: string;
+                /** @description Exact match on `created_until`. Equivalent to `?query=created_until:<value>`. */
+                created_until?: string;
+                /** @description Sort by one field: `<field>` ascending, `-<field>` descending. One of: createdAt, last_login, logins_count. Rows with no value in that field are left out. Default: `-createdAt`. */
+                sort?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `email`, `phone`. */
@@ -12432,6 +13086,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["User"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -15290,6 +15946,8 @@ export interface operations {
                 provider?: string;
                 /** @description Exact match on `created_at`. Equivalent to `?query=created_at:<value>`. */
                 created_at?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -15310,6 +15968,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Identity"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -15947,6 +16607,8 @@ export interface operations {
                 username?: string;
                 /** @description Exact match on `created_at`. Equivalent to `?query=created_at:<value>`. */
                 created_at?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -15969,6 +16631,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Credential"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -16756,6 +17420,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`. */
@@ -16776,6 +17442,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Role"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -17660,6 +18328,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -17680,6 +18350,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["RoleMember"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -18041,6 +18713,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `slug`. */
@@ -18061,6 +18735,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Team"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -19107,6 +19783,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `slug`. */
@@ -19127,6 +19805,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Organization"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -21199,6 +21879,8 @@ export interface operations {
                 user?: string;
                 /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
                 team?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -21219,6 +21901,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["TeamMember"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -23139,6 +23823,8 @@ export interface operations {
                 enforce_policies?: string;
                 /** @description Exact match on `allow_offline_access`. Equivalent to `?query=allow_offline_access:<value>`. */
                 allow_offline_access?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
@@ -23159,6 +23845,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Api"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -23288,6 +23976,24 @@ export interface operations {
                     enforce_policies?: boolean;
                     /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
                     allow_offline_access?: boolean;
+                    consent_options?: {
+                        /** @description Access token claim that carries the chosen id. */
+                        claim: string;
+                        /** @description What the screen asks for, e.g. "Project". */
+                        label: string;
+                        /** @description GET endpoint of the resource server that lists the choices. */
+                        url: string;
+                        /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                        audience: string;
+                        /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                        scope?: string;
+                    };
+                    delegation?: {
+                        /** @description The confidential client of the resource server allowed to exchange. */
+                        client_id: string;
+                        /** @description Identifier of the registered API the new token is for. */
+                        audience: string;
+                    };
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
                     /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
@@ -23337,6 +24043,24 @@ export interface operations {
                         enforce_policies: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
+                        consent_options?: {
+                            /** @description Access token claim that carries the chosen id. */
+                            claim: string;
+                            /** @description What the screen asks for, e.g. "Project". */
+                            label: string;
+                            /** @description GET endpoint of the resource server that lists the choices. */
+                            url: string;
+                            /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                            audience: string;
+                            /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                            scope?: string;
+                        } | null;
+                        delegation?: {
+                            /** @description The confidential client of the resource server allowed to exchange. */
+                            client_id: string;
+                            /** @description Identifier of the registered API the new token is for. */
+                            audience: string;
+                        } | null;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
                         /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
@@ -23493,6 +24217,24 @@ export interface operations {
                         enforce_policies: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
+                        consent_options?: {
+                            /** @description Access token claim that carries the chosen id. */
+                            claim: string;
+                            /** @description What the screen asks for, e.g. "Project". */
+                            label: string;
+                            /** @description GET endpoint of the resource server that lists the choices. */
+                            url: string;
+                            /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                            audience: string;
+                            /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                            scope?: string;
+                        } | null;
+                        delegation?: {
+                            /** @description The confidential client of the resource server allowed to exchange. */
+                            client_id: string;
+                            /** @description Identifier of the registered API the new token is for. */
+                            audience: string;
+                        } | null;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
                         /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
@@ -23638,6 +24380,24 @@ export interface operations {
                     enforce_policies?: boolean;
                     /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
                     allow_offline_access?: boolean;
+                    consent_options?: {
+                        /** @description Access token claim that carries the chosen id. */
+                        claim: string;
+                        /** @description What the screen asks for, e.g. "Project". */
+                        label: string;
+                        /** @description GET endpoint of the resource server that lists the choices. */
+                        url: string;
+                        /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                        audience: string;
+                        /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                        scope?: string;
+                    } | null;
+                    delegation?: {
+                        /** @description The confidential client of the resource server allowed to exchange. */
+                        client_id: string;
+                        /** @description Identifier of the registered API the new token is for. */
+                        audience: string;
+                    } | null;
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
                     /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
@@ -23687,6 +24447,24 @@ export interface operations {
                         enforce_policies: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
+                        consent_options?: {
+                            /** @description Access token claim that carries the chosen id. */
+                            claim: string;
+                            /** @description What the screen asks for, e.g. "Project". */
+                            label: string;
+                            /** @description GET endpoint of the resource server that lists the choices. */
+                            url: string;
+                            /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                            audience: string;
+                            /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                            scope?: string;
+                        } | null;
+                        delegation?: {
+                            /** @description The confidential client of the resource server allowed to exchange. */
+                            client_id: string;
+                            /** @description Identifier of the registered API the new token is for. */
+                            audience: string;
+                        } | null;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
                         /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
@@ -23849,6 +24627,24 @@ export interface operations {
                         enforce_policies: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
+                        consent_options?: {
+                            /** @description Access token claim that carries the chosen id. */
+                            claim: string;
+                            /** @description What the screen asks for, e.g. "Project". */
+                            label: string;
+                            /** @description GET endpoint of the resource server that lists the choices. */
+                            url: string;
+                            /** @description Identifier of a registered API the listing token is issued for (usually the resource server behind `url`). */
+                            audience: string;
+                            /** @description Space-separated permissions of the listing token. The token is delegated (`act`): the resource server sees auth acting for the user with only these, never the user’s full powers — an admin is listed their own choices, not the whole platform’s. */
+                            scope?: string;
+                        } | null;
+                        delegation?: {
+                            /** @description The confidential client of the resource server allowed to exchange. */
+                            client_id: string;
+                            /** @description Identifier of the registered API the new token is for. */
+                            audience: string;
+                        } | null;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
                         /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
@@ -24178,6 +24974,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -24196,6 +24994,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Action"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -25861,6 +26661,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -25879,6 +26681,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["LoginFlow"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -26799,6 +27603,8 @@ export interface operations {
                 channel?: string;
                 /** @description Exact match on `events`. Equivalent to `?query=events:<value>`. */
                 events?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -26817,6 +27623,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["NotificationSubscription"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -28227,6 +29035,8 @@ export interface operations {
                 expires_before?: string;
                 /** @description Exact match on `expires_after`. Equivalent to `?query=expires_after:<value>`. */
                 expires_after?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -28249,6 +29059,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Log"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -28511,6 +29323,8 @@ export interface operations {
                 since?: string;
                 /** @description Exact match on `until`. Equivalent to `?query=until:<value>`. */
                 until?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -28531,6 +29345,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Session"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -29048,6 +29864,8 @@ export interface operations {
                 cursor?: string;
                 /** @description Cursor returned by the previous page */
                 next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `domain`. */
@@ -29068,6 +29886,8 @@ export interface operations {
                     "application/json": {
                         next: string | null;
                         results: components["schemas"]["Customdomain"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
@@ -31436,6 +32256,7 @@ export interface operations {
                         refresh_token?: string;
                         id_token?: string;
                         scope?: string;
+                        issued_token_type?: string;
                     };
                 };
             };
@@ -31573,6 +32394,7 @@ export interface operations {
                         refresh_token?: string;
                         id_token?: string;
                         scope?: string;
+                        issued_token_type?: string;
                     };
                 };
             };
@@ -32309,6 +33131,48 @@ export interface operations {
             };
         };
     };
+    "oauth/authorizationServerMetadata": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "oauth/jwks": {
         parameters: {
             query?: never;
@@ -32558,7 +33422,7 @@ export interface operations {
                 content: {
                     "application/json": {
                         client_id: string;
-                        client_secret: string;
+                        client_secret?: string;
                         /** @description Unix timestamp (seconds) at which the client_id was issued */
                         client_id_issued_at: number;
                         /** @description 0 if the client_secret does not expire */
@@ -32654,6 +33518,85 @@ export interface operations {
             };
         };
     };
+    "oauth/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    token: string;
+                    token_type_hint?: string;
+                    client_id?: string;
+                    client_secret?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_client` — The `client_id` in the request does not name a client of this account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_client" | "validation_error";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "usernamepassword/login": {
         parameters: {
             query?: never;