@faable/auth-sdk 2.9.0 → 2.9.2

package/dist/api/types.d.ts

@@ -1080,6 +1080,34 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/role/{role_id}/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the permissions of a Role
+         * @description Lists the Api permissions the Role grants, each with its Api. A user gets them in tokens for an Api with `rbac` enabled when the Role is assigned to them at the account level.
+         */
+        get: operations["role/permissions"];
+        put?: never;
+        /**
+         * Add permissions to a Role
+         * @description Grants Api permissions to a Role. Each must be in the catalog of an Api of this tenant. Permissions the Role already has are kept. Tokens issued from now on (refreshes included) carry them; tokens already issued are unchanged. Leaves an entry in the tenant's log.
+         */
+        post: operations["role/add_permissions"];
+        /**
+         * Remove permissions from a Role
+         * @description Revokes Api permissions from a Role. Permissions the Role does not have are ignored. Tokens already issued keep them until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+         */
+        delete: operations["role/remove_permissions"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/role": {
         parameters: {
             query?: never;
@@ -1150,6 +1178,58 @@ export interface paths {
          * @description Assign Users to Role
          */
         post: operations["role/assign_users"];
+        /**
+         * Remove Users from Role
+         * @description Revokes an account-level role from users. Their next tokens (refreshes included) no longer carry its permissions; tokens already issued keep them until they expire. Leaves an entry in the tenant's log.
+         */
+        delete: operations["role/remove_users"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/{user_id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a User's roles
+         * @description Lists the roles assigned to the User at the account level, by name. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+         */
+        get: operations["user/roles"];
+        put?: never;
+        /**
+         * Assign roles to a User
+         * @description Assigns account-level roles to the User and returns all of their roles. Roles the User already has are kept. Their next tokens (refreshes included) carry the new permissions. Leaves an entry in the tenant's log. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+         */
+        post: operations["user/assign_roles"];
+        /**
+         * Remove roles from a User
+         * @description Removes account-level roles from the User and returns the ones left. Roles the User does not have are ignored. Tokens already issued keep the permissions until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+         */
+        delete: operations["user/remove_roles"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/{user_id}/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a User's permissions
+         * @description Lists the Api permissions the User holds through their account-level roles, with the roles that grant each one. For an Api with `rbac` enabled, these are exactly what the User's tokens for that Api carry in `permissions`.
+         */
+        get: operations["user/permissions"];
+        put?: never;
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
@@ -6682,6 +6762,19 @@ export interface components {
             name: string;
             /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
             description: string;
+            /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+            permissions: {
+                /**
+                 * @description Id of the Api that defines the permission.
+                 * @example api_6555fd293acc2f0fac0e3452
+                 */
+                api: string;
+                /**
+                 * @description The permission, as it appears in the Api's `permissions` catalog.
+                 * @example invites:write
+                 */
+                value: string;
+            }[];
             /** @description Object is related with this account */
             account: string;
             /**
@@ -7021,6 +7114,8 @@ export interface components {
             token_lifetime: number;
             /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
             enforce_policies: boolean;
+            /** @description Role-based access control. When true, a token issued to a user carries only the permissions of this API granted to the user's roles (account-level role assignments, not team roles): `permissions` lists all of them, and `scope` keeps only the requested ones the user holds. Machine-to-machine tokens (`client_credentials`) are not affected. The `permissions` claim requires `token_dialect: access_token_authz`. */
+            rbac: boolean;
             /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
             allow_offline_access: boolean;
             consent_options?: {
@@ -7099,6 +7194,8 @@ export interface components {
             token_lifetime?: number;
             /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
             enforce_policies?: boolean;
+            /** @description When true, user tokens carry only the permissions granted to the user's roles. Defaults to false. */
+            rbac?: boolean;
             /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
             allow_offline_access?: boolean;
             consent_options?: {
@@ -7146,6 +7243,8 @@ export interface components {
             token_lifetime?: number;
             /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
             enforce_policies?: boolean;
+            /** @description When true, user tokens carry only the permissions granted to the user's roles. Applies to tokens issued after the update, including refreshes. */
+            rbac?: boolean;
             /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
             allow_offline_access?: boolean;
             consent_options?: {
@@ -8649,6 +8748,7 @@ export interface components {
          *     - `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.
          *     - `role_not_found` (404): No role with that id in this account.
          *     - `invalid_role` (400): The role belongs to another account.
+         *     - `invalid_permission` (400): A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
          *     - `flow_not_found` (400): The login flow does not exist in this account.
          *     - `revision_not_found` (404): The revision is not in the flow history.
          *     - `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.
@@ -8658,7 +8758,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "invalid_permission" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -18663,24 +18763,13 @@ export interface operations {
             };
         };
     };
-    "role/list": {
+    "role/permissions": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Also return `total`: the rows matching the whole filter, across every page. */
-                count?: boolean;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Full-text search across: `name`, `description`. */
-                q?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                role_id: string;
+            };
             cookie?: never;
         };
         requestBody?: never;
@@ -18692,22 +18781,26 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["Role"][];
-                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
-                        total?: number;
-                    };
+                        /** @description Id of the Api that defines it. */
+                        api: string;
+                        /**
+                         * @description Audience of that Api: the `aud` of the tokens that carry this permission.
+                         * @example https://api.example.com
+                         */
+                        api_identifier: string;
+                        /** @description Name of that Api. */
+                        api_name: string;
+                        /**
+                         * @description The permission, as it appears in the `permissions` claim.
+                         * @example invites:write
+                         */
+                        value: string;
+                        /** @description The permission's description in the Api. */
+                        description?: string;
+                    }[];
                 };
             };
-            /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -18715,7 +18808,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -18749,7 +18842,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -18757,7 +18854,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -18787,66 +18884,74 @@ export interface operations {
             };
         };
     };
-    "role/create": {
+    "role/add_permissions": {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                role_id: string;
+            };
             cookie?: never;
         };
-        /** @description RoleCreate */
+        /** @description Permissions to add to or remove from a role. */
         requestBody: {
             content: {
                 "application/json": {
                     /**
-                     * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
-                     * @example admin
+                     * @description Permissions to grant or revoke, each as the Api id plus the value from its catalog.
+                     * @example [
+                     *       {
+                     *         "api": "api_6555fd293acc2f0fac0e3452",
+                     *         "value": "invites:write"
+                     *       }
+                     *     ]
                      */
-                    name: string;
-                    /** @description Free-form explanation of what users in this role are expected to do or have access to. */
-                    description?: string;
-                    /** @description Add Metadata */
-                    metadata?: {
-                        [key: string]: unknown;
-                    };
+                    permissions: {
+                        /**
+                         * @description Id of the Api that defines the permission.
+                         * @example api_6555fd293acc2f0fac0e3452
+                         */
+                        api: string;
+                        /**
+                         * @description The permission, as it appears in the Api's `permissions` catalog.
+                         * @example invites:write
+                         */
+                        value: string;
+                    }[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
                 };
             };
         };
         responses: {
-            /** @description Role */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Role ID */
-                        id: string;
+                        /** @description Id of the Api that defines it. */
+                        api: string;
                         /**
-                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
-                         * @example admin
+                         * @description Audience of that Api: the `aud` of the tokens that carry this permission.
+                         * @example https://api.example.com
                          */
-                        name: string;
-                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
-                        description: string;
-                        /** @description Object is related with this account */
-                        account: string;
+                        api_identifier: string;
+                        /** @description Name of that Api. */
+                        api_name: string;
                         /**
-                         * @description RoleMetadata
-                         * @default {}
+                         * @description The permission, as it appears in the `permissions` claim.
+                         * @example invites:write
                          */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Role creation date */
-                        createdAt: string;
-                        /** @description Role updated date */
-                        updatedAt?: string;
-                    };
+                        value: string;
+                        /** @description The permission's description in the Api. */
+                        description?: string;
+                    }[];
                 };
             };
             /**
-             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             * @description `invalid_permission` — A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -18857,7 +18962,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "already_exists" | "validation_error";
+                        error_code?: "invalid_permission" | "validation_error";
                     };
                 };
             };
@@ -18891,7 +18996,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -18899,7 +19008,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -18929,7 +19038,7 @@ export interface operations {
             };
         };
     };
-    "role/get": {
+    "role/remove_permissions": {
         parameters: {
             query?: never;
             header?: never;
@@ -18938,47 +19047,64 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Permissions to add to or remove from a role. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Permissions to grant or revoke, each as the Api id plus the value from its catalog.
+                     * @example [
+                     *       {
+                     *         "api": "api_6555fd293acc2f0fac0e3452",
+                     *         "value": "invites:write"
+                     *       }
+                     *     ]
+                     */
+                    permissions: {
+                        /**
+                         * @description Id of the Api that defines the permission.
+                         * @example api_6555fd293acc2f0fac0e3452
+                         */
+                        api: string;
+                        /**
+                         * @description The permission, as it appears in the Api's `permissions` catalog.
+                         * @example invites:write
+                         */
+                        value: string;
+                    }[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
+                };
+            };
+        };
         responses: {
-            /** @description Role */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Role ID */
-                        id: string;
+                        /** @description Id of the Api that defines it. */
+                        api: string;
                         /**
-                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
-                         * @example admin
+                         * @description Audience of that Api: the `aud` of the tokens that carry this permission.
+                         * @example https://api.example.com
                          */
-                        name: string;
-                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
-                        description: string;
-                        /** @description Object is related with this account */
-                        account: string;
+                        api_identifier: string;
+                        /** @description Name of that Api. */
+                        api_name: string;
                         /**
-                         * @description RoleMetadata
-                         * @default {}
+                         * @description The permission, as it appears in the `permissions` claim.
+                         * @example invites:write
                          */
-                        metadata: {
-                            [key: string]: unknown;
-                        };
-                        /** @description Role creation date */
-                        createdAt: string;
-                        /** @description Role updated date */
-                        updatedAt?: string;
-                    };
+                        value: string;
+                        /** @description The permission's description in the Api. */
+                        description?: string;
+                    }[];
                 };
             };
-            /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -18986,7 +19112,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -19062,43 +19188,1130 @@ export interface operations {
             };
         };
     };
-    "role/update": {
+    "role/list": {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                role_id: string;
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Also return `total`: the rows matching the whole filter, across every page. */
+                count?: boolean;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Full-text search across: `name`, `description`. */
+                q?: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
-        /** @description Partial update for a Role. Only the supplied fields are modified. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description New human-readable identifier for the role. */
-                    name?: string;
-                    /** @description New free-form description of what users in this role do. */
-                    description?: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Role */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description Role ID */
-                        id: string;
-                        /**
+                        next: string | null;
+                        results: components["schemas"]["Role"][];
+                        /** @description Rows matching the whole filter, across every page. Only with `?count=true`. */
+                        total?: number;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description RoleCreate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
+                     * @example admin
+                     */
+                    name: string;
+                    /** @description Free-form explanation of what users in this role are expected to do or have access to. */
+                    description?: string;
+                    /** @description Add Metadata */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable identifier for the role. */
+                    name?: string;
+                    /** @description New free-form description of what users in this role do. */
+                    description?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/users": {
+        parameters: {
+            query?: {
+                /** @description Start from this cursor */
+                cursor?: string;
+                /** @description Start from this cursor */
+                next?: string;
+                /** @description Size of the results array */
+                pageSize?: number;
+            };
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description PaginatedResponse */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description next cursor */
+                        next: string | null;
+                        /** @description List of results */
+                        results: components["schemas"]["RoleMember"][];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `role_not_found` — No role with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "role_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/assign_users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    users: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_role` — The role belongs to another account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_role" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `role_not_found` — No role with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "role_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "role/remove_users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for revoking a role from one or more users. Sent to `DELETE /role/:role_id/users`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description User ids to revoke the role from. A user that does not hold it is reported in `not_in_role`, not an error.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    users: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        removed_from_role: string[];
+                        not_in_role: string[];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_role` — The role belongs to another account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_role" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "user/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
                          * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
                          * @example admin
                          */
                         name: string;
                         /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -19112,16 +20325,10 @@ export interface operations {
                         createdAt: string;
                         /** @description Role updated date */
                         updatedAt?: string;
-                    };
+                    }[];
                 };
             };
-            /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
-             *
-             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19129,7 +20336,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -19205,18 +20412,33 @@ export interface operations {
             };
         };
     };
-    "role/delete": {
+    "user/assign_roles": {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                role_id: string;
+                user_id: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Account-level roles to assign to or remove from a user. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Role ids of this tenant.
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles: string[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
+                };
+            };
+        };
         responses: {
-            /** @description Role */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -19232,6 +20454,19 @@ export interface operations {
                         name: string;
                         /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -19245,11 +20480,11 @@ export interface operations {
                         createdAt: string;
                         /** @description Role updated date */
                         updatedAt?: string;
-                    };
+                    }[];
                 };
             };
             /**
-             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             * @description `invalid_role` — The role belongs to another account.
              *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
@@ -19260,7 +20495,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_id" | "validation_error";
+                        error_code?: "invalid_role" | "validation_error";
                     };
                 };
             };
@@ -19336,36 +20571,75 @@ export interface operations {
             };
         };
     };
-    "role/users": {
+    "user/remove_roles": {
         parameters: {
-            query?: {
-                /** @description Start from this cursor */
-                cursor?: string;
-                /** @description Start from this cursor */
-                next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
-            };
+            query?: never;
             header?: never;
             path: {
-                role_id: string;
+                user_id: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /** @description Account-level roles to assign to or remove from a user. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Role ids of this tenant.
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles: string[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
+                };
+            };
+        };
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
-                        next: string | null;
-                        /** @description List of results */
-                        results: components["schemas"]["RoleMember"][];
-                    };
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Api permissions granted to the users that hold this role at the account level (team roles grant none). Change them with `POST` / `DELETE /role/:role_id/permissions`; `GET /role/:role_id/permissions` lists them with their Api. */
+                        permissions: {
+                            /**
+                             * @description Id of the Api that defines the permission.
+                             * @example api_6555fd293acc2f0fac0e3452
+                             */
+                            api: string;
+                            /**
+                             * @description The permission, as it appears in the Api's `permissions` catalog.
+                             * @example invites:write
+                             */
+                            value: string;
+                        }[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    }[];
                 };
             };
             /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
@@ -19411,7 +20685,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `role_not_found` — No role with that id in this account.
+             * @description `not_found` — The resource does not exist in this account.
              *
              *     `account_not_found` — No Auth Account matches the request (domain, header or token).
              */
@@ -19422,7 +20696,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "role_not_found" | "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -19452,42 +20726,49 @@ export interface operations {
             };
         };
     };
-    "role/assign_users": {
+    "user/permissions": {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                role_id: string;
+                user_id: string;
             };
             cookie?: never;
         };
-        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
-                     * @example [
-                     *       "user_6555fd293acc2f0fac0e3452"
-                     *     ]
-                     */
-                    users: string[];
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Id of the Api that defines it. */
+                        api: string;
+                        /**
+                         * @description Audience of that Api: the `aud` of the tokens that carry this permission.
+                         * @example https://api.example.com
+                         */
+                        api_identifier: string;
+                        /** @description Name of that Api. */
+                        api_name: string;
+                        /**
+                         * @description The permission, as it appears in the `permissions` claim.
+                         * @example invites:write
+                         */
+                        value: string;
+                        /** @description The permission's description in the Api. */
+                        description?: string;
+                        /** @description The roles of the user that grant it. */
+                        roles: {
+                            id: string;
+                            name: string;
+                        }[];
+                    }[];
+                };
             };
-            /**
-             * @description `invalid_role` — The role belongs to another account.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
-             */
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19495,7 +20776,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_role" | "validation_error";
+                        error_code?: "validation_error";
                     };
                 };
             };
@@ -19530,7 +20811,7 @@ export interface operations {
                 };
             };
             /**
-             * @description `role_not_found` — No role with that id in this account.
+             * @description `not_found` — The resource does not exist in this account.
              *
              *     `account_not_found` — No Auth Account matches the request (domain, header or token).
              */
@@ -19541,7 +20822,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "role_not_found" | "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -25075,6 +26356,8 @@ export interface operations {
                 token_dialect?: string;
                 /** @description Exact match on `enforce_policies`. Equivalent to `?query=enforce_policies:<value>`. */
                 enforce_policies?: string;
+                /** @description Exact match on `rbac`. Equivalent to `?query=rbac:<value>`. */
+                rbac?: string;
                 /** @description Exact match on `allow_offline_access`. Equivalent to `?query=allow_offline_access:<value>`. */
                 allow_offline_access?: string;
                 /** @description Also return `total`: the rows matching the whole filter, across every page. */
@@ -25228,6 +26511,8 @@ export interface operations {
                     token_lifetime?: number;
                     /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
                     enforce_policies?: boolean;
+                    /** @description When true, user tokens carry only the permissions granted to the user's roles. Defaults to false. */
+                    rbac?: boolean;
                     /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
                     allow_offline_access?: boolean;
                     consent_options?: {
@@ -25295,6 +26580,8 @@ export interface operations {
                         token_lifetime: number;
                         /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
                         enforce_policies: boolean;
+                        /** @description Role-based access control. When true, a token issued to a user carries only the permissions of this API granted to the user's roles (account-level role assignments, not team roles): `permissions` lists all of them, and `scope` keeps only the requested ones the user holds. Machine-to-machine tokens (`client_credentials`) are not affected. The `permissions` claim requires `token_dialect: access_token_authz`. */
+                        rbac: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
                         consent_options?: {
@@ -25469,6 +26756,8 @@ export interface operations {
                         token_lifetime: number;
                         /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
                         enforce_policies: boolean;
+                        /** @description Role-based access control. When true, a token issued to a user carries only the permissions of this API granted to the user's roles (account-level role assignments, not team roles): `permissions` lists all of them, and `scope` keeps only the requested ones the user holds. Machine-to-machine tokens (`client_credentials`) are not affected. The `permissions` claim requires `token_dialect: access_token_authz`. */
+                        rbac: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
                         consent_options?: {
@@ -25632,6 +26921,8 @@ export interface operations {
                     token_lifetime?: number;
                     /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
                     enforce_policies?: boolean;
+                    /** @description When true, user tokens carry only the permissions granted to the user's roles. Applies to tokens issued after the update, including refreshes. */
+                    rbac?: boolean;
                     /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
                     allow_offline_access?: boolean;
                     consent_options?: {
@@ -25699,6 +26990,8 @@ export interface operations {
                         token_lifetime: number;
                         /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
                         enforce_policies: boolean;
+                        /** @description Role-based access control. When true, a token issued to a user carries only the permissions of this API granted to the user's roles (account-level role assignments, not team roles): `permissions` lists all of them, and `scope` keeps only the requested ones the user holds. Machine-to-machine tokens (`client_credentials`) are not affected. The `permissions` claim requires `token_dialect: access_token_authz`. */
+                        rbac: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
                         consent_options?: {
@@ -25879,6 +27172,8 @@ export interface operations {
                         token_lifetime: number;
                         /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
                         enforce_policies: boolean;
+                        /** @description Role-based access control. When true, a token issued to a user carries only the permissions of this API granted to the user's roles (account-level role assignments, not team roles): `permissions` lists all of them, and `scope` keeps only the requested ones the user holds. Machine-to-machine tokens (`client_credentials`) are not affected. The `permissions` claim requires `token_dialect: access_token_authz`. */
+                        rbac: boolean;
                         /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
                         allow_offline_access: boolean;
                         consent_options?: {