@faable/auth-sdk 2.9.0 → 2.9.1

package/dist/api/generated-client.d.ts

@@ -1155,6 +1155,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1209,6 +1210,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1264,6 +1266,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1320,6 +1323,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1358,6 +1362,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1399,6 +1404,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1455,6 +1461,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -5356,6 +5363,31 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             ok: boolean;
         } | null;
     }>;
+    /**
+     * `POST /role/{role_id}/permissions` — operationId: `role/add_permissions`
+     *
+     * Add permissions to a Role
+     *
+     * Grants Api permissions to a Role. Each must be in the catalog of an Api of this tenant. Permissions the Role already has are kept. Tokens issued from now on (refreshes included) carry them; tokens already issued are unchanged. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_permission` (400) — A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleAddPermissions(role_id: string, data: OpBody<"role/add_permissions">): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
     /**
      * `POST /role/{role_id}/users` — operationId: `role/assign_users`
      *
@@ -5392,6 +5424,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5419,6 +5455,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5447,6 +5487,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5476,6 +5520,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5487,6 +5535,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5501,6 +5553,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5509,6 +5565,76 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `GET /role/{role_id}/permissions` — operationId: `role/permissions`
+     *
+     * List the permissions of a Role
+     *
+     * Lists the Api permissions the Role grants, each with its Api. A user gets them in tokens for an Api with `rbac` enabled when the Role is assigned to them at the account level.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    rolePermissions(role_id: string): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
+    /**
+     * `DELETE /role/{role_id}/permissions` — operationId: `role/remove_permissions`
+     *
+     * Remove permissions from a Role
+     *
+     * Revokes Api permissions from a Role. Permissions the Role does not have are ignored. Tokens already issued keep them until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemovePermissions(role_id: string, data: OpBody<"role/remove_permissions">): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
+    /**
+     * `DELETE /role/{role_id}/users` — operationId: `role/remove_users`
+     *
+     * Remove Users from Role
+     *
+     * Revokes an account-level role from users. Their next tokens (refreshes included) no longer carry its permissions; tokens already issued keep them until they expire. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemoveUsers(role_id: string, data: OpBody<"role/remove_users">): Promise<{
+        removed_from_role: string[];
+        not_in_role: string[];
+    }>;
     /**
      * `POST /role/{role_id}` — operationId: `role/update`
      *
@@ -5530,6 +5656,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -6521,6 +6651,39 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `POST /user/{user_id}/roles` — operationId: `user/assign_roles`
+     *
+     * Assign roles to a User
+     *
+     * Assigns account-level roles to the User and returns all of their roles. Roles the User already has are kept. Their next tokens (refreshes included) carry the new permissions. Leaves an entry in the tenant's log. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userAssignRoles(user_id: string, data: OpBody<"user/assign_roles">): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user` — operationId: `user/create`
      *
@@ -7351,6 +7514,66 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         ticket_id: string;
         channel: "email" | "sms" | "whatsapp" | "factor";
     }>;
+    /**
+     * `GET /user/{user_id}/permissions` — operationId: `user/permissions`
+     *
+     * List a User's permissions
+     *
+     * Lists the Api permissions the User holds through their account-level roles, with the roles that grant each one. For an Api with `rbac` enabled, these are exactly what the User's tokens for that Api carry in `permissions`.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userPermissions(user_id: string): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+        roles: {
+            id: string;
+            name: string;
+        }[];
+    }[]>;
+    /**
+     * `DELETE /user/{user_id}/roles` — operationId: `user/remove_roles`
+     *
+     * Remove roles from a User
+     *
+     * Removes account-level roles from the User and returns the ones left. Roles the User does not have are ignored. Tokens already issued keep the permissions until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRemoveRoles(user_id: string, data: OpBody<"user/remove_roles">): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
      *
@@ -7391,6 +7614,38 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "revoked" | "already_used";
         id: string;
     }>;
+    /**
+     * `GET /user/{user_id}/roles` — operationId: `user/roles`
+     *
+     * List a User's roles
+     *
+     * Lists the roles assigned to the User at the account level, by name. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRoles(user_id: string): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user/{user_id}` — operationId: `user/update`
      *

package/dist/api/generated-client.js

@@ -1810,6 +1810,28 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("domain", domain);
         return this.fetcher.post(`/organization/${organization_id}/domain/${domain}/verify`, {});
     }
+    /**
+     * `POST /role/{role_id}/permissions` — operationId: `role/add_permissions`
+     *
+     * Add permissions to a Role
+     *
+     * Grants Api permissions to a Role. Each must be in the catalog of an Api of this tenant. Permissions the Role already has are kept. Tokens issued from now on (refreshes included) carry them; tokens already issued are unchanged. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_permission` (400) — A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleAddPermissions(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.post(`/role/${role_id}/permissions`, data);
+    }
     /**
      * `POST /role/{role_id}/users` — operationId: `role/assign_users`
      *
@@ -1909,6 +1931,70 @@ export class GeneratedFaableAuthApi extends FaableApi {
     roleList(params) {
         return this.paginator({ url: `/role`, params });
     }
+    /**
+     * `GET /role/{role_id}/permissions` — operationId: `role/permissions`
+     *
+     * List the permissions of a Role
+     *
+     * Lists the Api permissions the Role grants, each with its Api. A user gets them in tokens for an Api with `rbac` enabled when the Role is assigned to them at the account level.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    rolePermissions(role_id) {
+        requireId("role_id", role_id);
+        return this.fetcher.get(`/role/${role_id}/permissions`);
+    }
+    /**
+     * `DELETE /role/{role_id}/permissions` — operationId: `role/remove_permissions`
+     *
+     * Remove permissions from a Role
+     *
+     * Revokes Api permissions from a Role. Permissions the Role does not have are ignored. Tokens already issued keep them until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemovePermissions(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.request({ method: "DELETE", url: `/role/${role_id}/permissions`, data });
+    }
+    /**
+     * `DELETE /role/{role_id}/users` — operationId: `role/remove_users`
+     *
+     * Remove Users from Role
+     *
+     * Revokes an account-level role from users. Their next tokens (refreshes included) no longer carry its permissions; tokens already issued keep them until they expire. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemoveUsers(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.request({ method: "DELETE", url: `/role/${role_id}/users`, data });
+    }
     /**
      * `POST /role/{role_id}` — operationId: `role/update`
      *
@@ -2481,6 +2567,28 @@ export class GeneratedFaableAuthApi extends FaableApi {
     teammemberList(params) {
         return this.paginator({ url: `/teammember`, params });
     }
+    /**
+     * `POST /user/{user_id}/roles` — operationId: `user/assign_roles`
+     *
+     * Assign roles to a User
+     *
+     * Assigns account-level roles to the User and returns all of their roles. Roles the User already has are kept. Their next tokens (refreshes included) carry the new permissions. Leaves an entry in the tenant's log. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userAssignRoles(user_id, data) {
+        requireId("user_id", user_id);
+        return this.fetcher.post(`/user/${user_id}/roles`, data);
+    }
     /**
      * `POST /user` — operationId: `user/create`
      *
@@ -2707,6 +2815,48 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("user_id", user_id);
         return this.fetcher.post(`/user/${user_id}/password-setup`, data);
     }
+    /**
+     * `GET /user/{user_id}/permissions` — operationId: `user/permissions`
+     *
+     * List a User's permissions
+     *
+     * Lists the Api permissions the User holds through their account-level roles, with the roles that grant each one. For an Api with `rbac` enabled, these are exactly what the User's tokens for that Api carry in `permissions`.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userPermissions(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/permissions`);
+    }
+    /**
+     * `DELETE /user/{user_id}/roles` — operationId: `user/remove_roles`
+     *
+     * Remove roles from a User
+     *
+     * Removes account-level roles from the User and returns the ones left. Roles the User does not have are ignored. Tokens already issued keep the permissions until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRemoveRoles(user_id, data) {
+        requireId("user_id", user_id);
+        return this.fetcher.request({ method: "DELETE", url: `/user/${user_id}/roles`, data });
+    }
     /**
      * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
      *
@@ -2749,6 +2899,27 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("ticket_id", ticket_id);
         return this.fetcher.post(`/user/${user_id}/tickets/${ticket_id}/revoke`, {});
     }
+    /**
+     * `GET /user/{user_id}/roles` — operationId: `user/roles`
+     *
+     * List a User's roles
+     *
+     * Lists the roles assigned to the User at the account level, by name. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRoles(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/roles`);
+    }
     /**
      * `POST /user/{user_id}` — operationId: `user/update`
      *