@faable/auth-sdk 2.7.93 → 2.7.95

package/dist/api/types.d.ts

@@ -1716,6 +1716,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account/keys/saml": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the SAML signing certificates
+         * @description The X.509 certificate this Account signs SAML assertions with, and the next one when a rotation is staged. Separate from the JWKS keys: rotating tokens never touches SAML. Created on first use.
+         */
+        get: operations["account/getSamlKeys"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/account/keys/saml/rotate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate the SAML signing certificate
+         * @description Two steps. The first call stages a new certificate: the IdP metadata publishes both and signing continues with the current one, so each Service Provider can be updated. The second call promotes it: assertions are signed with the new certificate and the old one is dropped.
+         */
+        post: operations["account/rotateSamlKeys"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account/keys": {
         parameters: {
             query?: never;
@@ -5208,6 +5248,70 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/saml/metadata/{client_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * SAML IdP metadata
+         * @description This tenant's SAML 2.0 IdP metadata for one client: entity ID, single sign-on URL and signing certificates. Paste it, or its URL, into the Service Provider.
+         */
+        get: operations["saml/metadata"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/saml/sso/{client_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * SAML single sign-on
+         * @description Single sign-on service (HTTP-Redirect and HTTP-POST bindings). With a SAMLRequest it answers the Service Provider; without one it starts an IdP-initiated login. The signed response is posted to the client's configured ACS URL.
+         */
+        get: operations["saml/sso"];
+        put?: never;
+        /**
+         * SAML single sign-on
+         * @description Single sign-on service (HTTP-Redirect and HTTP-POST bindings). With a SAMLRequest it answers the Service Provider; without one it starts an IdP-initiated login. The signed response is posted to the client's configured ACS URL.
+         */
+        post: operations["saml/sso_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/saml/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * SAML bridge callback
+         * @description Internal: where the login flow returns to finish a SAML sign-on. Not for direct use.
+         */
+        get: operations["saml/callback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/usernamepassword/login": {
         parameters: {
             query?: never;
@@ -5818,6 +5922,25 @@ export interface components {
             login_flow?: string | null;
             /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
             default_audience?: string | null;
+            saml_sp?: {
+                /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                enabled: boolean;
+                /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                entity_id: string;
+                /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                acs_url: string;
+                /**
+                 * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                 * @enum {unknown}
+                 */
+                nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                attribute_mapping?: {
+                    [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                };
+                /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                sign_response?: boolean;
+            } | null;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -5939,6 +6062,25 @@ export interface components {
             login_flow?: string | null;
             /** @description Audience a client_credentials token request gets when it sends none. An explicit `audience` wins. `null` removes it. */
             default_audience?: string | null;
+            saml_sp?: {
+                /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                enabled: boolean;
+                /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                entity_id: string;
+                /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                acs_url: string;
+                /**
+                 * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                 * @enum {unknown}
+                 */
+                nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                attribute_mapping?: {
+                    [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                };
+                /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                sign_response?: boolean;
+            } | null;
             /** @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta. Omit it to leave the metadata untouched. */
             metadata?: {
                 [key: string]: unknown;
@@ -7954,6 +8096,10 @@ export interface components {
          *     - `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.
          *     - `ambiguous_connection` (400): Several connections match; pass `connection_id`.
          *     - `invalid_redirect_uri` (400): The redirect URI is not registered for the client.
+         *     - `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.
+         *     - `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.
+         *     - `saml_not_enabled` (404): This client does not have SAML enabled.
+         *     - `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.
          *     - `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.
          *     - `audience_not_found` (403): The `audience` does not name an API registered in this account.
          *     - `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.
@@ -8024,7 +8170,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -12000,6 +12146,25 @@ export interface operations {
                         login_flow?: string | null;
                         /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
                         default_audience?: string | null;
+                        saml_sp?: {
+                            /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                            enabled: boolean;
+                            /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                            entity_id: string;
+                            /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                            acs_url: string;
+                            /**
+                             * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                             * @enum {unknown}
+                             */
+                            nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                            /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                            attribute_mapping?: {
+                                [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                            };
+                            /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                            sign_response?: boolean;
+                        } | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -12205,6 +12370,25 @@ export interface operations {
                         login_flow?: string | null;
                         /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
                         default_audience?: string | null;
+                        saml_sp?: {
+                            /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                            enabled: boolean;
+                            /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                            entity_id: string;
+                            /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                            acs_url: string;
+                            /**
+                             * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                             * @enum {unknown}
+                             */
+                            nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                            /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                            attribute_mapping?: {
+                                [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                            };
+                            /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                            sign_response?: boolean;
+                        } | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -12403,6 +12587,25 @@ export interface operations {
                     login_flow?: string | null;
                     /** @description Audience a client_credentials token request gets when it sends none. An explicit `audience` wins. `null` removes it. */
                     default_audience?: string | null;
+                    saml_sp?: {
+                        /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                        enabled: boolean;
+                        /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                        entity_id: string;
+                        /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                        acs_url: string;
+                        /**
+                         * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                         * @enum {unknown}
+                         */
+                        nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                        /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                        attribute_mapping?: {
+                            [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                        };
+                        /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                        sign_response?: boolean;
+                    } | null;
                     /** @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta. Omit it to leave the metadata untouched. */
                     metadata?: {
                         [key: string]: unknown;
@@ -12505,6 +12708,25 @@ export interface operations {
                         login_flow?: string | null;
                         /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
                         default_audience?: string | null;
+                        saml_sp?: {
+                            /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                            enabled: boolean;
+                            /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                            entity_id: string;
+                            /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                            acs_url: string;
+                            /**
+                             * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                             * @enum {unknown}
+                             */
+                            nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                            /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                            attribute_mapping?: {
+                                [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                            };
+                            /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                            sign_response?: boolean;
+                        } | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -12716,6 +12938,25 @@ export interface operations {
                         login_flow?: string | null;
                         /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
                         default_audience?: string | null;
+                        saml_sp?: {
+                            /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                            enabled: boolean;
+                            /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                            entity_id: string;
+                            /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                            acs_url: string;
+                            /**
+                             * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                             * @enum {unknown}
+                             */
+                            nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                            /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                            attribute_mapping?: {
+                                [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                            };
+                            /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                            sign_response?: boolean;
+                        } | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -12925,6 +13166,25 @@ export interface operations {
                         login_flow?: string | null;
                         /** @description Audience used when a client_credentials token request sends none (e.g. `faable:management:<account_id>`). An explicit `audience` in the request wins. Absent = `${iss}/userinfo`. */
                         default_audience?: string | null;
+                        saml_sp?: {
+                            /** @description Whether this client answers SAML requests. Off keeps the configuration but every /saml route of the client returns 404. */
+                            enabled: boolean;
+                            /** @description The Service Provider's Entity ID. Its AuthnRequests must carry it as Issuer, and every assertion is restricted to it as Audience. */
+                            entity_id: string;
+                            /** @description The Service Provider's Assertion Consumer Service URL (HTTP-POST binding), https. The only URL a response is ever posted to: an AuthnRequest naming another one is refused. */
+                            acs_url: string;
+                            /**
+                             * @description `emailAddress` (default) sends the email as NameID; `persistent` sends the stable user id; `unspecified` sends the email when the user has one, the user id otherwise.
+                             * @enum {unknown}
+                             */
+                            nameid_format?: "emailAddress" | "persistent" | "unspecified";
+                            /** @description SAML attribute name → user field. Omit for the default (email, name, given_name, family_name). Custom ID token claims set by post-login actions are added as attributes too. */
+                            attribute_mapping?: {
+                                [key: string]: "user_id" | "email" | "email_verified" | "name" | "given_name" | "family_name" | "nickname" | "picture" | "phone_number";
+                            };
+                            /** @description Also sign the Response envelope, not only the Assertion. Default true; a few SPs reject a doubly-signed message. */
+                            sign_response?: boolean;
+                        } | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -24759,7 +25019,7 @@ export interface operations {
             };
         };
     };
-    "account/getKeys": {
+    "account/getSamlKeys": {
         parameters: {
             query?: never;
             header?: never;
@@ -24775,12 +25035,20 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /** @description kid currently used to sign new tokens */
-                        production_kid: string;
-                        /** @description kid that will be promoted on the next rotation */
-                        next_in_queue_kid: string;
-                        /** @description All kids currently published in the JWK Set */
-                        kids_active: string[];
+                        current: {
+                            id: string;
+                            /** @description PEM X.509 certificate */
+                            certificate: string;
+                            /** Format: date-time */
+                            not_after: string;
+                        };
+                        next?: {
+                            id: string;
+                            /** @description PEM X.509 certificate */
+                            certificate: string;
+                            /** Format: date-time */
+                            not_after: string;
+                        };
                     };
                 };
             };
@@ -24852,18 +25120,14 @@ export interface operations {
             };
         };
     };
-    "account/rotateKeys": {
+    "account/rotateSamlKeys": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": Record<string, never>;
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
@@ -24872,28 +25136,9 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /** @description ISO 8601 timestamp of the rotation */
-                        rotated_at: string;
-                        /** @description kid that was active before rotation. Tokens signed with it are still verifiable via /.well-known/jwks.json */
-                        previous_production_kid: string;
-                        /** @description kid now used to sign new tokens */
-                        production_kid: string;
-                        /** @description kid that will be promoted on the next rotation */
-                        next_in_queue_kid: string;
-                        /** @description All kids currently published in the JWK Set */
-                        kids_active: string[];
-                    };
-                };
-            };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "validation_error";
+                        step: "staged" | "promoted";
+                        current_id: string;
+                        next_id?: string;
                     };
                 };
             };
@@ -24965,20 +25210,9 @@ export interface operations {
             };
         };
     };
-    "action/list": {
+    "account/getKeys": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Also return `total`: the rows matching the whole filter, across every page. */
-                count?: boolean;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
@@ -24992,30 +25226,12 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["Action"][];
-                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
-                        total?: number;
-                    };
-                };
-            };
-            /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorResponse"] & {
-                        /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        /** @description kid currently used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
                     };
                 };
             };
@@ -25087,7 +25303,7 @@ export interface operations {
             };
         };
     };
-    "action/create": {
+    "account/rotateKeys": {
         parameters: {
             query?: never;
             header?: never;
@@ -25096,76 +25312,31 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    /** @description Action Name */
-                    name: string;
-                    /** @description JavaScript code. Must export at least one hook: exports.onExecutePostLogin, exports.onExecuteContinue and/or exports.onExecuteClientCredentials. The triggers are derived from the exported hooks. */
-                    code: string;
-                    /**
-                     * @description Is this action active?
-                     * @default true
-                     */
-                    enabled?: boolean;
-                    /**
-                     * @description Execution order: lower runs first; on ties the newest action runs first
-                     * @default 0
-                     */
-                    order?: number;
-                };
+                "application/json": Record<string, never>;
             };
         };
         responses: {
-            /** @description Action */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Action ID */
-                        id: string;
-                        /** @description Action Name */
-                        name: string;
-                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
-                        triggers: ("continue" | "post-login" | "client-credentials")[];
-                        /** @description JavaScript Code to execute */
-                        code: string;
-                        /**
-                         * @description Is this action active?
-                         * @default true
-                         */
-                        enabled: boolean;
-                        /**
-                         * @description Execution order: lower runs first; on ties the newest action runs first
-                         * @default 0
-                         */
-                        order: number;
-                        /**
-                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
-                         * @default 1
-                         */
-                        revision: number;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description ActionMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Action creation date */
-                        createdAt: string;
-                        /** @description Action updated date */
-                        updatedAt?: string;
+                        /** @description ISO 8601 timestamp of the rotation */
+                        rotated_at: string;
+                        /** @description kid that was active before rotation. Tokens signed with it are still verifiable via /.well-known/jwks.json */
+                        previous_production_kid: string;
+                        /** @description kid now used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
                     };
                 };
             };
-            /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -25173,7 +25344,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -25245,68 +25416,47 @@ export interface operations {
             };
         };
     };
-    "action/get": {
+    "action/list": {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                action_id: string;
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
+                /** @description Filter using a FaableQL query */
+                query?: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Action */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Action ID */
-                        id: string;
-                        /** @description Action Name */
-                        name: string;
-                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
-                        triggers: ("continue" | "post-login" | "client-credentials")[];
-                        /** @description JavaScript Code to execute */
-                        code: string;
-                        /**
-                         * @description Is this action active?
-                         * @default true
-                         */
-                        enabled: boolean;
-                        /**
-                         * @description Execution order: lower runs first; on ties the newest action runs first
-                         * @default 0
-                         */
-                        order: number;
-                        /**
-                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
-                         * @default 1
-                         */
-                        revision: number;
-                        /** @description Object is related with this account */
-                        account: string;
-                        /**
-                         * @description ActionMetadata
-                         * @default {}
-                         */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Action creation date */
-                        createdAt: string;
-                        /** @description Action updated date */
-                        updatedAt?: string;
+                        next: string | null;
+                        results: components["schemas"]["Action"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
                     };
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
              *
              *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
              *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -25316,7 +25466,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
                     };
                 };
             };
@@ -25350,11 +25500,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -25362,7 +25508,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -25392,26 +25538,29 @@ export interface operations {
             };
         };
     };
-    "action/update": {
+    "action/create": {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                action_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        /** @description Partial update for an Action. Only the supplied fields are modified; `triggers` is read-only and follows `code`. */
         requestBody: {
             content: {
                 "application/json": {
                     /** @description Action Name */
-                    name?: string;
-                    /** @description JavaScript code. The triggers are re-derived from the hooks it exports. */
-                    code?: string;
-                    /** @description Is this action active? */
+                    name: string;
+                    /** @description JavaScript code. Must export at least one hook: exports.onExecutePostLogin, exports.onExecuteContinue and/or exports.onExecuteClientCredentials. The triggers are derived from the exported hooks. */
+                    code: string;
+                    /**
+                     * @description Is this action active?
+                     * @default true
+                     */
                     enabled?: boolean;
-                    /** @description Execution order */
+                    /**
+                     * @description Execution order: lower runs first; on ties the newest action runs first
+                     * @default 0
+                     */
                     order?: number;
                 };
             };
@@ -25464,9 +25613,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -25477,7 +25624,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "already_exists" | "validation_error";
                     };
                 };
             };
@@ -25511,11 +25658,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `not_found` — The resource does not exist in this account.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -25523,7 +25666,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "not_found" | "account_not_found";
+                        error_code?: "account_not_found";
                     };
                 };
             };
@@ -25553,7 +25696,7 @@ export interface operations {
             };
         };
     };
-    "action/delete": {
+    "action/get": {
         parameters: {
             query?: never;
             header?: never;
@@ -25613,6 +25756,8 @@ export interface operations {
             /**
              * @description `invalid_id` — The id in the path is not a valid id for this resource.
              *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -25622,7 +25767,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
                     };
                 };
             };
@@ -25698,76 +25843,84 @@ export interface operations {
             };
         };
     };
-    "loginflow/resolved": {
+    "action/update": {
         parameters: {
-            query?: {
-                client_id?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                action_id: string;
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Partial update for an Action. Only the supplied fields are modified; `triggers` is read-only and follows `code`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Action Name */
+                    name?: string;
+                    /** @description JavaScript code. The triggers are re-derived from the hooks it exports. */
+                    code?: string;
+                    /** @description Is this action active? */
+                    enabled?: boolean;
+                    /** @description Execution order */
+                    order?: number;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description Action */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        source: "compiled" | "published";
-                        flow_id: string | null;
+                        /** @description Action ID */
+                        id: string;
+                        /** @description Action Name */
+                        name: string;
+                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
+                        triggers: ("continue" | "post-login" | "client-credentials")[];
+                        /** @description JavaScript Code to execute */
+                        code: string;
+                        /**
+                         * @description Is this action active?
+                         * @default true
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Execution order: lower runs first; on ties the newest action runs first
+                         * @default 0
+                         */
+                        order: number;
+                        /**
+                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
+                         * @default 1
+                         */
                         revision: number;
-                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                        graph: {
-                            nodes: {
-                                id: string;
-                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                config?: {
-                                    [key: string]: unknown;
-                                };
-                            }[];
-                            edges: {
-                                from: string;
-                                handle: string;
-                                to: string;
-                            }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ActionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
                         };
-                        bound: {
-                            flow_id: string;
-                            bound_to: "account" | "client";
-                            name: string;
-                            revision: number;
-                            published_revision: number | null;
-                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                            draft: {
-                                nodes: {
-                                    id: string;
-                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                    config?: {
-                                        [key: string]: unknown;
-                                    };
-                                }[];
-                                edges: {
-                                    from: string;
-                                    handle: string;
-                                    to: string;
-                                }[];
-                            };
-                            /** @description Node positions in the editor. Presentation only. */
-                            layout?: {
-                                [key: string]: {
-                                    x: number;
-                                    y: number;
-                                };
-                            };
-                            history: number[];
-                        } | null;
+                        /** @description Action creation date */
+                        createdAt: string;
+                        /** @description Action updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -25775,7 +25928,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "validation_error";
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
                     };
                 };
             };
@@ -25809,15 +25962,19 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
-            404: {
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -25847,114 +26004,68 @@ export interface operations {
             };
         };
     };
-    "loginflow/materialize": {
+    "action/delete": {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    client_id?: string;
-                    name?: string;
-                };
+            path: {
+                action_id: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description LoginFlow */
+            /** @description Action */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description LoginFlow ID */
+                        /** @description Action ID */
                         id: string;
+                        /** @description Action Name */
                         name: string;
-                        /** @enum {string} */
-                        trigger: "login";
-                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                        graph: {
-                            nodes: {
-                                id: string;
-                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                config?: {
-                                    [key: string]: unknown;
-                                };
-                            }[];
-                            edges: {
-                                from: string;
-                                handle: string;
-                                to: string;
-                            }[];
-                        };
-                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        /** @description Triggers this action runs on. Derived from the hooks the code exports (`onExecutePostLogin` → post-login, `onExecuteContinue` → continue, `onExecuteClientCredentials` → client-credentials); read-only. */
+                        triggers: ("continue" | "post-login" | "client-credentials")[];
+                        /** @description JavaScript Code to execute */
+                        code: string;
+                        /**
+                         * @description Is this action active?
+                         * @default true
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Execution order: lower runs first; on ties the newest action runs first
+                         * @default 0
+                         */
+                        order: number;
+                        /**
+                         * @description Monotonic edit counter — increments on every update. Audit rows stamp the revision that produced each allow/deny (`data.action_revision`); `updatedAt` dates the current revision.
+                         * @default 1
+                         */
                         revision: number;
-                        published?: {
-                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                            graph: {
-                                nodes: {
-                                    id: string;
-                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                    config?: {
-                                        [key: string]: unknown;
-                                    };
-                                }[];
-                                edges: {
-                                    from: string;
-                                    handle: string;
-                                    to: string;
-                                }[];
-                            };
-                            revision: number;
-                            published_at: string;
-                        };
-                        /** @description Previously published graphs, newest first, for rollback. */
-                        history: {
-                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
-                            graph: {
-                                nodes: {
-                                    id: string;
-                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
-                                    config?: {
-                                        [key: string]: unknown;
-                                    };
-                                }[];
-                                edges: {
-                                    from: string;
-                                    handle: string;
-                                    to: string;
-                                }[];
-                            };
-                            revision: number;
-                            published_at: string;
-                        }[];
-                        /** @description Node positions in the editor. Presentation only. */
-                        layout?: {
-                            [key: string]: {
-                                x: number;
-                                y: number;
-                            };
-                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
-                         * @description LoginFlowMetadata
+                         * @description ActionMetadata
                          * @default {}
                          */
                         metadata: {
                             [key: string]: unknown;
                         };
-                        /** @description LoginFlow creation date */
+                        /** @description Action creation date */
                         createdAt: string;
-                        /** @description LoginFlow updated date */
+                        /** @description Action updated date */
                         updatedAt?: string;
                     };
                 };
             };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -25962,7 +26073,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "validation_error";
+                        error_code?: "invalid_id" | "validation_error";
                     };
                 };
             };
@@ -25996,7 +26107,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -26004,7 +26119,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -26034,22 +26149,16 @@ export interface operations {
             };
         };
     };
-    "loginflow/validate": {
+    "loginflow/resolved": {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                loginflow_id: string;
+            query?: {
+                client_id?: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    client_id?: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
@@ -26058,13 +26167,54 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        ok: boolean;
-                        issues: {
-                            code: string;
-                            node?: string;
-                            handle?: string;
-                            message: string;
-                        }[];
+                        source: "compiled" | "published";
+                        flow_id: string | null;
+                        revision: number;
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        bound: {
+                            flow_id: string;
+                            bound_to: "account" | "client";
+                            name: string;
+                            revision: number;
+                            published_revision: number | null;
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            draft: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            /** @description Node positions in the editor. Presentation only. */
+                            layout?: {
+                                [key: string]: {
+                                    x: number;
+                                    y: number;
+                                };
+                            };
+                            history: number[];
+                        } | null;
                     };
                 };
             };
@@ -26148,19 +26298,18 @@ export interface operations {
             };
         };
     };
-    "loginflow/publish": {
+    "loginflow/materialize": {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                loginflow_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
                 "application/json": {
                     client_id?: string;
+                    name?: string;
                 };
             };
         };
@@ -26310,23 +26459,6 @@ export interface operations {
                     };
                 };
             };
-            /** @description Default Response */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        error: string;
-                        issues: {
-                            code: string;
-                            node?: string;
-                            handle?: string;
-                            message: string;
-                        }[];
-                    };
-                };
-            };
             /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
             429: {
                 headers: {
@@ -26353,7 +26485,7 @@ export interface operations {
             };
         };
     };
-    "loginflow/rollback": {
+    "loginflow/validate": {
         parameters: {
             query?: never;
             header?: never;
@@ -26365,23 +26497,137 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    revision: number;
+                    client_id?: string;
                 };
             };
         };
         responses: {
-            /** @description LoginFlow */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description LoginFlow ID */
-                        id: string;
-                        name: string;
+                        ok: boolean;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        trigger: "login";
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
                         /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
                         graph: {
                             nodes: {
@@ -26503,11 +26749,7 @@ export interface operations {
                     };
                 };
             };
-            /**
-             * @description `revision_not_found` — The revision is not in the flow history.
-             *
-             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
-             */
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -26515,7 +26757,24 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "revision_not_found" | "account_not_found";
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description Default Response */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        error: string;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
                     };
                 };
             };
@@ -26545,7 +26804,7 @@ export interface operations {
             };
         };
     };
-    "loginflow/previewToken": {
+    "loginflow/rollback": {
         parameters: {
             query?: never;
             header?: never;
@@ -26554,25 +26813,106 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    revision: number;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description LoginFlow */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        token: string;
-                        expires_in: number;
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /**
-             * @description `flow_not_found` — The login flow does not exist in this account.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -26580,7 +26920,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "flow_not_found" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -26614,7 +26954,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `revision_not_found` — The revision is not in the flow history.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -26622,7 +26966,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "revision_not_found" | "account_not_found";
                     };
                 };
             };
@@ -26652,22 +26996,129 @@ export interface operations {
             };
         };
     };
-    "loginflow/list": {
+    "loginflow/previewToken": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Also return `total`: the rows matching the whole filter, across every page. */
-                count?: boolean;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        token: string;
+                        expires_in: number;
+                    };
+                };
+            };
+            /**
+             * @description `flow_not_found` — The login flow does not exist in this account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "flow_not_found" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+            };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
@@ -33597,6 +34048,334 @@ export interface operations {
             };
         };
     };
+    "saml/metadata": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `saml_not_enabled` — This client does not have SAML enabled.
+             *
+             *     `client_not_found` — No client with that `client_id`.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "saml_not_enabled" | "client_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "saml/sso": {
+        parameters: {
+            query?: {
+                SAMLRequest?: string;
+                RelayState?: string;
+                SigAlg?: string;
+                Signature?: string;
+            };
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_saml_request` — The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.
+             *
+             *     `saml_sp_mismatch` — The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_saml_request" | "saml_sp_mismatch" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `saml_not_enabled` — This client does not have SAML enabled.
+             *
+             *     `client_not_found` — No client with that `client_id`.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "saml_not_enabled" | "client_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "saml/sso_post": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    SAMLRequest?: string;
+                    RelayState?: string;
+                    SigAlg?: string;
+                    Signature?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_saml_request` — The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.
+             *
+             *     `saml_sp_mismatch` — The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_saml_request" | "saml_sp_mismatch" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `saml_not_enabled` — This client does not have SAML enabled.
+             *
+             *     `client_not_found` — No client with that `client_id`.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "saml_not_enabled" | "client_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "saml/callback": {
+        parameters: {
+            query: {
+                state: string;
+                code?: string;
+                error?: string;
+                error_description?: string;
+                iss?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_state" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `saml_not_enabled` — This client does not have SAML enabled.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "saml_not_enabled" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "usernamepassword/login": {
         parameters: {
             query?: never;