@faable/auth-sdk 2.8.20 → 2.8.22

package/dist/api/api-types.d.ts

@@ -108,6 +108,7 @@ export type UserAppCreate = components["schemas"]["UserAppCreate"];
 export type UserAppMetadata = components["schemas"]["UserAppMetadata"];
 export type UserAppMetadataUpdate = components["schemas"]["UserAppMetadataUpdate"];
 export type UserCreate = components["schemas"]["UserCreate"];
+export type UserIpInsight = components["schemas"]["UserIpInsight"];
 export type UserMetadata = components["schemas"]["UserMetadata"];
 export type UserUpdate = components["schemas"]["UserUpdate"];
 export type UserUserCreate = components["schemas"]["UserUserCreate"];

package/dist/api/generated-client.d.ts

@@ -463,22 +463,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[]; /**
-             * `POST /user/import` — operationId: `user/import`
-             *
-             * Import users, with their password hashes
-             *
-             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
-             *
-             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-             */
+            callback_hostnames: string[];
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;
@@ -548,22 +533,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[]; /**
-             * `POST /user/import` — operationId: `user/import`
-             *
-             * Import users, with their password hashes
-             *
-             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
-             *
-             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-             */
+            callback_hostnames: string[];
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;
@@ -636,22 +606,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[]; /**
-             * `POST /user/import` — operationId: `user/import`
-             *
-             * Import users, with their password hashes
-             *
-             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
-             *
-             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-             */
+            callback_hostnames: string[];
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;
@@ -5769,6 +5724,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "active" | "revoked";
         ip?: string | undefined;
         user_agent?: string | undefined;
+        language?: string | undefined;
         device_name?: string | undefined;
         client?: unknown;
         connection?: unknown;
@@ -5809,6 +5765,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            language?: string | undefined;
             device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
@@ -5831,6 +5788,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            language?: string | undefined;
             device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
@@ -5856,6 +5814,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            language?: string | undefined;
             device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
@@ -5897,6 +5856,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "active" | "revoked";
         ip?: string | undefined;
         user_agent?: string | undefined;
+        language?: string | undefined;
         device_name?: string | undefined;
         client?: unknown;
         connection?: unknown;
@@ -6919,6 +6879,52 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
         }[];
     }>;
+    /**
+     * `GET /user/{user_id}/ip` — operationId: `user/ip`
+     *
+     * Insight into a user's last IP
+     *
+     * Location and network (country, ASN), reputation signals and usage of the user's `last_ip`. Empty when the user has never logged in.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userIp(user_id: string): Promise<{
+        ip?: string | undefined;
+        geo?: {
+            country_code?: string | undefined;
+            country_name?: string | undefined;
+            continent?: string | undefined;
+            asn?: number | undefined;
+            as_org?: string | undefined;
+            source: {
+                name: string;
+                url: string;
+                license: string;
+                edition: string;
+            };
+        } | undefined;
+        signals?: {
+            datacenter: boolean;
+            apple_private_relay: boolean;
+            active_blocks: number;
+            network_active_blocks: number;
+            suspended_denies: number;
+            network_suspended_denies: number;
+        } | undefined;
+        activity?: {
+            logins: number;
+            first_login_at?: string | undefined;
+            active_sessions: number;
+            other_users: number;
+        } | undefined;
+    }>;
     /**
      * `GET /user` — operationId: `user/list`
      *

package/dist/api/generated-client.js

@@ -2623,6 +2623,26 @@ export class GeneratedFaableAuthApi extends FaableApi {
     userImport(data) {
         return this.fetcher.post(`/user/import`, data);
     }
+    /**
+     * `GET /user/{user_id}/ip` — operationId: `user/ip`
+     *
+     * Insight into a user's last IP
+     *
+     * Location and network (country, ASN), reputation signals and usage of the user's `last_ip`. Empty when the user has never logged in.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userIp(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/ip`);
+    }
     /**
      * `GET /user` — operationId: `user/list`
      *

package/dist/api/types.d.ts

@@ -880,6 +880,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/ip": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Insight into a user's last IP
+         * @description Location and network (country, ASN), reputation signals and usage of the user's `last_ip`. Empty when the user has never logged in.
+         */
+        get: operations["user/ip"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user/import": {
         parameters: {
             query?: never;
@@ -5928,6 +5948,17 @@ export interface components {
                 label: string;
                 url: string;
             };
+            /** @description How a passwordless type behaves. Present only on types of the `passwordless` category. */
+            passwordless?: {
+                /** @description Digits in an emailed code. */
+                code_length: number;
+                /** @description Seconds an emailed code stays valid. */
+                code_ttl_seconds: number;
+                /** @description Seconds a magic link stays valid. */
+                link_ttl_seconds: number;
+                /** @description One email per address in this window: a start inside it sends nothing new. */
+                resend_interval_seconds: number;
+            };
             /** @description The credentials a tenant fills in for its own app, when they are more than a client id and a secret (Apple). Absent means client id + secret. */
             credential_fields?: {
                 /** @description Connection field this input writes, as a dotted path (`client_id`, `provider_options.team_id`). */
@@ -6486,6 +6517,42 @@ export interface components {
             last_used_at?: string;
             remaining?: number;
         };
+        UserIpInsight: {
+            ip?: string;
+            geo?: {
+                country_code?: string;
+                country_name?: string;
+                continent?: string;
+                asn?: number;
+                as_org?: string;
+                /** @description Where the location comes from. The data is CC BY 4.0: anything that shows it must credit this source. */
+                source: {
+                    name: string;
+                    url: string;
+                    license: string;
+                    edition: string;
+                };
+            };
+            /** @description The same values a tenant Action reads as `event.request.ip_*` for a login from this IP now. */
+            signals?: {
+                datacenter: boolean;
+                apple_private_relay: boolean;
+                active_blocks: number;
+                network_active_blocks: number;
+                suspended_denies: number;
+                network_suspended_denies: number;
+            };
+            activity?: {
+                /** @description This user's logins from this IP in the last year. */
+                logins: number;
+                /** Format: date-time */
+                first_login_at?: string;
+                /** @description This user's active sessions last seen from this IP. */
+                active_sessions: number;
+                /** @description Other users of this tenant whose last login came from this IP. */
+                other_users: number;
+            };
+        };
         /** @description Identity */
         Identity: {
             /** @description Identity ID */
@@ -7981,6 +8048,8 @@ export interface components {
             ip?: string;
             /** @description Raw `User-Agent` header at the last authentication. */
             user_agent?: string;
+            /** @description First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`. */
+            language?: string;
             /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
             device_name?: string;
             client?: components["schemas"]["Client"] | string | unknown;
@@ -16524,6 +16593,106 @@ export interface operations {
             };
         };
     };
+    "user/ip": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UserIpInsight"];
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "user/import": {
         parameters: {
             query?: never;
@@ -30584,6 +30753,8 @@ export interface operations {
                         ip?: string;
                         /** @description Raw `User-Agent` header at the last authentication. */
                         user_agent?: string;
+                        /** @description First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`. */
+                        language?: string;
                         /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
                         device_name?: string;
                         client?: components["schemas"]["Client"] | string | unknown;
@@ -30739,6 +30910,8 @@ export interface operations {
                         ip?: string;
                         /** @description Raw `User-Agent` header at the last authentication. */
                         user_agent?: string;
+                        /** @description First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`. */
+                        language?: string;
                         /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
                         device_name?: string;
                         client?: components["schemas"]["Client"] | string | unknown;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.8.20";
+export const version = "2.8.22";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "f843227";
+export const commit = "9419803";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.8.20",
+  "version": "2.8.22",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.86.4",
+    "version": "2.88.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -1424,6 +1424,35 @@
             },
             "description": "Provider documentation for tenants registering their own OAuth app."
           },
+          "passwordless": {
+            "type": "object",
+            "required": [
+              "code_length",
+              "code_ttl_seconds",
+              "link_ttl_seconds",
+              "resend_interval_seconds"
+            ],
+            "properties": {
+              "code_length": {
+                "type": "integer",
+                "description": "Digits in an emailed code."
+              },
+              "code_ttl_seconds": {
+                "type": "integer",
+                "description": "Seconds an emailed code stays valid."
+              },
+              "link_ttl_seconds": {
+                "type": "integer",
+                "description": "Seconds a magic link stays valid."
+              },
+              "resend_interval_seconds": {
+                "type": "integer",
+                "description": "One email per address in this window: a start inside it sends nothing new."
+              }
+            },
+            "additionalProperties": false,
+            "description": "How a passwordless type behaves. Present only on types of the `passwordless` category."
+          },
           "credential_fields": {
             "type": "array",
             "items": {
@@ -3675,6 +3704,119 @@
           }
         }
       },
+      "UserIpInsight": {
+        "type": "object",
+        "properties": {
+          "ip": {
+            "type": "string"
+          },
+          "geo": {
+            "type": "object",
+            "required": [
+              "source"
+            ],
+            "properties": {
+              "country_code": {
+                "type": "string"
+              },
+              "country_name": {
+                "type": "string"
+              },
+              "continent": {
+                "type": "string"
+              },
+              "asn": {
+                "type": "integer"
+              },
+              "as_org": {
+                "type": "string"
+              },
+              "source": {
+                "type": "object",
+                "required": [
+                  "name",
+                  "url",
+                  "license",
+                  "edition"
+                ],
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "url": {
+                    "type": "string"
+                  },
+                  "license": {
+                    "type": "string"
+                  },
+                  "edition": {
+                    "type": "string"
+                  }
+                },
+                "description": "Where the location comes from. The data is CC BY 4.0: anything that shows it must credit this source."
+              }
+            }
+          },
+          "signals": {
+            "type": "object",
+            "required": [
+              "datacenter",
+              "apple_private_relay",
+              "active_blocks",
+              "network_active_blocks",
+              "suspended_denies",
+              "network_suspended_denies"
+            ],
+            "properties": {
+              "datacenter": {
+                "type": "boolean"
+              },
+              "apple_private_relay": {
+                "type": "boolean"
+              },
+              "active_blocks": {
+                "type": "integer"
+              },
+              "network_active_blocks": {
+                "type": "integer"
+              },
+              "suspended_denies": {
+                "type": "integer"
+              },
+              "network_suspended_denies": {
+                "type": "integer"
+              }
+            },
+            "description": "The same values a tenant Action reads as `event.request.ip_*` for a login from this IP now."
+          },
+          "activity": {
+            "type": "object",
+            "required": [
+              "logins",
+              "active_sessions",
+              "other_users"
+            ],
+            "properties": {
+              "logins": {
+                "type": "integer",
+                "description": "This user's logins from this IP in the last year."
+              },
+              "first_login_at": {
+                "type": "string",
+                "format": "date-time"
+              },
+              "active_sessions": {
+                "type": "integer",
+                "description": "This user's active sessions last seen from this IP."
+              },
+              "other_users": {
+                "type": "integer",
+                "description": "Other users of this tenant whose last login came from this IP."
+              }
+            }
+          }
+        }
+      },
       "Identity": {
         "type": "object",
         "required": [
@@ -7902,6 +8044,10 @@
             "type": "string",
             "description": "Raw `User-Agent` header at the last authentication."
           },
+          "language": {
+            "type": "string",
+            "description": "First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`."
+          },
           "device_name": {
             "type": "string",
             "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."
@@ -30892,6 +31038,195 @@
         }
       }
     },
+    "/user/{user_id}/ip": {
+      "get": {
+        "operationId": "user/ip",
+        "summary": "Insight into a user's last IP",
+        "tags": [
+          "user"
+        ],
+        "description": "Location and network (country, ASN), reputation signals and usage of the user's `last_ip`. Empty when the user has never logged in.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "user_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserIpInsight"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/user/import": {
       "post": {
         "operationId": "user/import",
@@ -62600,6 +62935,10 @@
                       "type": "string",
                       "description": "Raw `User-Agent` header at the last authentication."
                     },
+                    "language": {
+                      "type": "string",
+                      "description": "First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`."
+                    },
                     "device_name": {
                       "type": "string",
                       "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."
@@ -62941,6 +63280,10 @@
                       "type": "string",
                       "description": "Raw `User-Agent` header at the last authentication."
                     },
+                    "language": {
+                      "type": "string",
+                      "description": "First language tag of the browser's `Accept-Language` at the last authentication, e.g. `es-ES`."
+                    },
                     "device_name": {
                       "type": "string",
                       "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."