@flipdish/authorization 0.2.51 → 0.2.52

package/api.ts

@@ -23,6 +23,150 @@ import type { RequestArgs } from './base';
 // @ts-ignore
 import { BASE_PATH, COLLECTION_FORMATS, BaseAPI, RequiredError, operationServerMap } from './base';
 
+/**
+ * 
+ * @export
+ * @interface AcceptJoinRequest
+ */
+export interface AcceptJoinRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AcceptJoinRequest
+     */
+    'roleName'?: AcceptJoinRequestRoleNameEnum;
+    /**
+     * 
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
+     * @memberof AcceptJoinRequest
+     */
+    'propertyIds'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
+}
+
+export const AcceptJoinRequestRoleNameEnum = {
+    Owner: 'Owner',
+    PropertyOwner: 'PropertyOwner',
+    ManagedOwner: 'ManagedOwner',
+    Integrator: 'Integrator',
+    PropertyManager: 'PropertyManager',
+    FinanceManager: 'FinanceManager',
+    StaffMember: 'StaffMember',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
+
+export type AcceptJoinRequestRoleNameEnum = typeof AcceptJoinRequestRoleNameEnum[keyof typeof AcceptJoinRequestRoleNameEnum];
+
+/**
+ * 
+ * @export
+ * @interface AccessBlockStateResponse
+ */
+export interface AccessBlockStateResponse {
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof AccessBlockStateResponse
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponse
+     */
+    'reason'?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponse
+     */
+    'blockedAt': string;
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedBlockedBy}
+     * @memberof AccessBlockStateResponse
+     */
+    'blockedBy': AccessBlockStateResponseBlockedBlockedBy;
+}
+/**
+ * 
+ * @export
+ * @interface AccessBlockStateResponseBlocked
+ */
+export interface AccessBlockStateResponseBlocked {
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'reason'?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'blockedAt': string;
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedBlockedBy}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'blockedBy': AccessBlockStateResponseBlockedBlockedBy;
+}
+/**
+ * 
+ * @export
+ * @interface AccessBlockStateResponseBlockedBlockedBy
+ */
+export interface AccessBlockStateResponseBlockedBlockedBy {
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedBlockedBy
+     */
+    'principalId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedBlockedBy
+     */
+    'email': string;
+}
+/**
+ * 
+ * @export
+ * @interface AccessBlockStateResponseBlockedPrincipal
+ */
+export interface AccessBlockStateResponseBlockedPrincipal {
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedPrincipal
+     */
+    'type': AccessBlockStateResponseBlockedPrincipalTypeEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedPrincipal
+     */
+    'id': string;
+}
+
+export const AccessBlockStateResponseBlockedPrincipalTypeEnum = {
+    User: 'User',
+    Automation: 'Automation',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
+
+export type AccessBlockStateResponseBlockedPrincipalTypeEnum = typeof AccessBlockStateResponseBlockedPrincipalTypeEnum[keyof typeof AccessBlockStateResponseBlockedPrincipalTypeEnum];
+
 /**
  * 
  * @export
@@ -53,6 +197,12 @@ export interface AccessRequestResponse {
      * @memberof AccessRequestResponse
      */
     'requesterEmail': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessRequestResponse
+     */
+    'requesterName'?: string;
     /**
      * 
      * @type {string}
@@ -67,10 +217,10 @@ export interface AccessRequestResponse {
     'orgName': string;
     /**
      * 
-     * @type {Array<string>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof AccessRequestResponse
      */
-    'propertyIds': Array<string>;
+    'propertyIds': Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * 
      * @type {Array<string>}
@@ -756,6 +906,25 @@ export interface AuthorizeBatchChecks400ResponseAnyOfInner {
  */
 export interface AuthorizeBatchChecks400ResponseAnyOfInnerPathInner {
 }
+/**
+ * 
+ * @export
+ * @interface BlockPrincipalAccessRequest
+ */
+export interface BlockPrincipalAccessRequest {
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof BlockPrincipalAccessRequest
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     * 
+     * @type {string}
+     * @memberof BlockPrincipalAccessRequest
+     */
+    'reason'?: string;
+}
 /**
  * 
  * @export
@@ -1084,6 +1253,12 @@ export interface GetJoinAccessRequest200Response {
      * @memberof GetJoinAccessRequest200Response
      */
     'requesterEmail': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof GetJoinAccessRequest200Response
+     */
+    'requesterName'?: string;
     /**
      * 
      * @type {string}
@@ -1098,10 +1273,10 @@ export interface GetJoinAccessRequest200Response {
     'orgName': string;
     /**
      * 
-     * @type {Array<string>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof GetJoinAccessRequest200Response
      */
-    'propertyIds': Array<string>;
+    'propertyIds': Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * 
      * @type {Array<string>}
@@ -1162,6 +1337,13 @@ export const GetJoinAccessRequest200ResponseRoleNameEnum = {
 
 export type GetJoinAccessRequest200ResponseRoleNameEnum = typeof GetJoinAccessRequest200ResponseRoleNameEnum[keyof typeof GetJoinAccessRequest200ResponseRoleNameEnum];
 
+/**
+ * 
+ * @export
+ * @interface GetJoinAccessRequest200ResponsePropertyIdsInner
+ */
+export interface GetJoinAccessRequest200ResponsePropertyIdsInner {
+}
 /**
  * Successful user permissions retrieval response
  * @export
@@ -1690,10 +1872,10 @@ export interface ListOrgRolesSuccessResponseValue {
     'optionalPermissionSetKeys'?: Array<string>;
     /**
      * Property IDs, or * for all properties, the roles are scoped to
-     * @type {Array<ListOrgRolesSuccessResponseValuePropertiesInner>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof ListOrgRolesSuccessResponseValue
      */
-    'properties'?: Array<ListOrgRolesSuccessResponseValuePropertiesInner>;
+    'properties'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * Brand IDs, or * for all brands, the roles are scoped to
      * @type {Array<ListOrgRolesSuccessResponseValueBrandsInner>}
@@ -1736,13 +1918,6 @@ export interface ListOrgRolesSuccessResponseValueBrandsInner {
  */
 export interface ListOrgRolesSuccessResponseValueOrgId {
 }
-/**
- * 
- * @export
- * @interface ListOrgRolesSuccessResponseValuePropertiesInner
- */
-export interface ListOrgRolesSuccessResponseValuePropertiesInner {
-}
 /**
  * 
  * @export
@@ -1763,6 +1938,19 @@ export interface ListPermissionsSuccessResponse {
      */
     'permissions': Permissions & Array<Permissions>;
 }
+/**
+ * 
+ * @export
+ * @interface ListPrincipalAccessBlocksResponse
+ */
+export interface ListPrincipalAccessBlocksResponse {
+    /**
+     * 
+     * @type {Array<AccessBlockStateResponse>}
+     * @memberof ListPrincipalAccessBlocksResponse
+     */
+    'items': Array<AccessBlockStateResponse>;
+}
 /**
  * Successful roles retrieval response
  * @export
@@ -1776,6 +1964,19 @@ export interface ListRolesSuccessResponse {
      */
     'roles': Array<RoleNames>;
 }
+/**
+ * The caller\'s active timed access grants
+ * @export
+ * @interface ListTimedAccessGrantsResponse
+ */
+export interface ListTimedAccessGrantsResponse {
+    /**
+     * 
+     * @type {Array<TimedAccessGrant>}
+     * @memberof ListTimedAccessGrantsResponse
+     */
+    'grants': Array<TimedAccessGrant>;
+}
 /**
  * Permissions
  * @export
@@ -1846,6 +2047,7 @@ export const Permissions = {
     ViewMenu: 'ViewMenu',
     CreateGlobalApiKey: 'CreateGlobalAPIKey',
     ListGlobalApiKeys: 'ListGlobalAPIKeys',
+    BlockPrincipalAccess: 'BlockPrincipalAccess',
     CreateMenu: 'CreateMenu',
     UpdateMenu: 'UpdateMenu',
     DeleteMenu: 'DeleteMenu',
@@ -2116,7 +2318,7 @@ export interface RematerializeRoleAssignmentRequestBody {
     'sk': string;
 }
 /**
- * Successful role assignment rematerialization response
+ * Successful role assignment rematerialization response (reconcile: add missing + revoke leftovers)
  * @export
  * @interface RematerializeRoleAssignmentSuccessResponse
  */
@@ -2132,44 +2334,19 @@ export interface RematerializeRoleAssignmentSuccessResponse {
      * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'materialized': number;
+    'added': number;
     /**
      * 
      * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'applied': number;
+    'revoked': number;
     /**
      * 
-     * @type {Array<RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner>}
+     * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'policyAssignments': Array<RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner>;
-}
-/**
- * 
- * @export
- * @interface RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
- */
-export interface RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner {
-    /**
-     * 
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'policyId': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'assignmentPk': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'assignmentSk': string;
+    'unchanged': number;
 }
 /**
  * 
@@ -2342,10 +2519,10 @@ export interface RoleAssignmentRequestBody {
     'roleName': RoleAssignmentRequestBodyRoleNameEnum;
     /**
      * Property resource ids (e.g. p123) when scoped to properties
-     * @type {Array<ListOrgRolesSuccessResponseValuePropertiesInner>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof RoleAssignmentRequestBody
      */
-    'properties'?: Array<ListOrgRolesSuccessResponseValuePropertiesInner>;
+    'properties'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * Brand resource ids (e.g. b123) when scoped to brands
      * @type {Array<ListOrgRolesSuccessResponseValueBrandsInner>}
@@ -2510,71 +2687,351 @@ export type RoleNames = typeof RoleNames[keyof typeof RoleNames];
 
 
 /**
- * 
+ * A temporary timed access grant
  * @export
- * @interface UpdateGlobalApiKeyRequest
+ * @interface TimedAccessGrant
  */
-export interface UpdateGlobalApiKeyRequest {
+export interface TimedAccessGrant {
     /**
      * 
      * @type {string}
-     * @memberof UpdateGlobalApiKeyRequest
+     * @memberof TimedAccessGrant
      */
-    'name'?: string;
+    'grantId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'principalType': TimedAccessGrantPrincipalTypeEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'principalId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'email': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'orgId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'roleName': string;
     /**
      * 
      * @type {Array<string>}
-     * @memberof UpdateGlobalApiKeyRequest
+     * @memberof TimedAccessGrant
      */
-    'permissions'?: Array<string>;
+    'propertyIds': Array<string>;
     /**
      * 
-     * @type {Array<AuthorizationRequestResource>}
-     * @memberof UpdateGlobalApiKeyRequest
+     * @type {Array<string>}
+     * @memberof TimedAccessGrant
      */
-    'resources'?: Array<AuthorizationRequestResource>;
+    'brandIds': Array<string>;
     /**
      * 
-     * @type {boolean}
-     * @memberof UpdateGlobalApiKeyRequest
+     * @type {Array<string>}
+     * @memberof TimedAccessGrant
      */
-    'global'?: boolean;
+    'salesChannelIds': Array<string>;
     /**
      * 
      * @type {string}
-     * @memberof UpdateGlobalApiKeyRequest
+     * @memberof TimedAccessGrant
      */
-    'expiresAt'?: string;
+    'startsAt': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'expiresAt': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'status': TimedAccessGrantStatusEnum;
 }
 
-/**
- * APIKeysApi - axios parameter creator
- * @export
- */
-export const APIKeysApiAxiosParamCreator = function (configuration?: Configuration) {
-    return {
-        /**
-         * Create an Automation API key (optional org association). Requires CreateGlobalAPIKey. Raw secret is returned once.
-         * @summary Create global API key
-         * @param {CreateGlobalApiKeyRequest} [createGlobalApiKeyRequest] 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        createGlobalApiKey: async (createGlobalApiKeyRequest?: CreateGlobalApiKeyRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            const localVarPath = `/apiKeys`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
+export const TimedAccessGrantPrincipalTypeEnum = {
+    User: 'User',
+    Automation: 'Automation',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
 
-            // authentication ApiKeyAuth required
-            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+export type TimedAccessGrantPrincipalTypeEnum = typeof TimedAccessGrantPrincipalTypeEnum[keyof typeof TimedAccessGrantPrincipalTypeEnum];
+export const TimedAccessGrantStatusEnum = {
+    Active: 'active',
+    Expired: 'expired'
+} as const;
+
+export type TimedAccessGrantStatusEnum = typeof TimedAccessGrantStatusEnum[keyof typeof TimedAccessGrantStatusEnum];
+
+/**
+ * 
+ * @export
+ * @interface TimedAccessGrantRequestBody
+ */
+export interface TimedAccessGrantRequestBody {
+    /**
+     * Must match the authenticated caller
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'userId': string;
+    /**
+     * The org to grant temporary access to
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'orgId': string;
+    /**
+     * Role the pass grants
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'roleName': TimedAccessGrantRequestBodyRoleNameEnum;
+    /**
+     * Optional property scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'propertyIds'?: Array<string>;
+    /**
+     * Optional brand scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'brandIds'?: Array<string>;
+    /**
+     * Optional sales channel scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'salesChannelIds'?: Array<string>;
+}
+
+export const TimedAccessGrantRequestBodyRoleNameEnum = {
+    Owner: 'Owner'
+} as const;
+
+export type TimedAccessGrantRequestBodyRoleNameEnum = typeof TimedAccessGrantRequestBodyRoleNameEnum[keyof typeof TimedAccessGrantRequestBodyRoleNameEnum];
+
+/**
+ * The timed access grant that was created or refreshed
+ * @export
+ * @interface TimedAccessGrantResponse
+ */
+export interface TimedAccessGrantResponse {
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'grantId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'principalType': TimedAccessGrantResponsePrincipalTypeEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'principalId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'email': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'orgId': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'roleName': string;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'propertyIds': Array<string>;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'brandIds': Array<string>;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'salesChannelIds': Array<string>;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'startsAt': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'expiresAt': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'status': TimedAccessGrantResponseStatusEnum;
+}
+
+export const TimedAccessGrantResponsePrincipalTypeEnum = {
+    User: 'User',
+    Automation: 'Automation',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
+
+export type TimedAccessGrantResponsePrincipalTypeEnum = typeof TimedAccessGrantResponsePrincipalTypeEnum[keyof typeof TimedAccessGrantResponsePrincipalTypeEnum];
+export const TimedAccessGrantResponseStatusEnum = {
+    Active: 'active',
+    Expired: 'expired'
+} as const;
+
+export type TimedAccessGrantResponseStatusEnum = typeof TimedAccessGrantResponseStatusEnum[keyof typeof TimedAccessGrantResponseStatusEnum];
+
+/**
+ * 
+ * @export
+ * @interface UnblockPrincipalAccessRequest
+ */
+export interface UnblockPrincipalAccessRequest {
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof UnblockPrincipalAccessRequest
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+}
+/**
+ * 
+ * @export
+ * @interface UnblockPrincipalAccessResponse
+ */
+export interface UnblockPrincipalAccessResponse {
+    /**
+     * 
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof UnblockPrincipalAccessResponse
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     * 
+     * @type {string}
+     * @memberof UnblockPrincipalAccessResponse
+     */
+    'status': UnblockPrincipalAccessResponseStatusEnum;
+}
+
+export const UnblockPrincipalAccessResponseStatusEnum = {
+    RestorationInProgress: 'restoration_in_progress',
+    NotBlocked: 'not_blocked'
+} as const;
+
+export type UnblockPrincipalAccessResponseStatusEnum = typeof UnblockPrincipalAccessResponseStatusEnum[keyof typeof UnblockPrincipalAccessResponseStatusEnum];
+
+/**
+ * 
+ * @export
+ * @interface UpdateGlobalApiKeyRequest
+ */
+export interface UpdateGlobalApiKeyRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof UpdateGlobalApiKeyRequest
+     */
+    'name'?: string;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof UpdateGlobalApiKeyRequest
+     */
+    'permissions'?: Array<string>;
+    /**
+     * 
+     * @type {Array<AuthorizationRequestResource>}
+     * @memberof UpdateGlobalApiKeyRequest
+     */
+    'resources'?: Array<AuthorizationRequestResource>;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof UpdateGlobalApiKeyRequest
+     */
+    'global'?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof UpdateGlobalApiKeyRequest
+     */
+    'expiresAt'?: string;
+}
+
+/**
+ * APIKeysApi - axios parameter creator
+ * @export
+ */
+export const APIKeysApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Create an Automation API key (optional org association). Requires CreateGlobalAPIKey. Raw secret is returned once.
+         * @summary Create global API key
+         * @param {CreateGlobalApiKeyRequest} [createGlobalApiKeyRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createGlobalApiKey: async (createGlobalApiKeyRequest?: CreateGlobalApiKeyRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apiKeys`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
 
 
     
@@ -3986,14 +4443,15 @@ export class ConfigurationDataApi extends BaseAPI {
 export const JoinAccessApiAxiosParamCreator = function (configuration?: Configuration) {
     return {
         /**
-         * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+         * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
          * @summary Accept a pending join access request
          * @param {string} orgId 
          * @param {string} requestId 
+         * @param {AcceptJoinRequest} [acceptJoinRequest] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        acceptJoinAccessRequest: async (orgId: string, requestId: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+        acceptJoinAccessRequest: async (orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'orgId' is not null or undefined
             assertParamExists('acceptJoinAccessRequest', 'orgId', orgId)
             // verify required parameter 'requestId' is not null or undefined
@@ -4017,9 +4475,12 @@ export const JoinAccessApiAxiosParamCreator = function (configuration?: Configur
 
 
     
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(acceptJoinRequest, localVarRequestOptions, configuration)
 
             return {
                 url: toPathString(localVarUrlObj),
@@ -4248,15 +4709,16 @@ export const JoinAccessApiFp = function(configuration?: Configuration) {
     const localVarAxiosParamCreator = JoinAccessApiAxiosParamCreator(configuration)
     return {
         /**
-         * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+         * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
          * @summary Accept a pending join access request
          * @param {string} orgId 
          * @param {string} requestId 
+         * @param {AcceptJoinRequest} [acceptJoinRequest] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        async acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetJoinAccessRequest200Response>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.acceptJoinAccessRequest(orgId, requestId, options);
+        async acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetJoinAccessRequest200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.acceptJoinAccessRequest(orgId, requestId, acceptJoinRequest, options);
             const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
             const localVarOperationServerBasePath = operationServerMap['JoinAccessApi.acceptJoinAccessRequest']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -4343,15 +4805,16 @@ export const JoinAccessApiFactory = function (configuration?: Configuration, bas
     const localVarFp = JoinAccessApiFp(configuration)
     return {
         /**
-         * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+         * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
          * @summary Accept a pending join access request
          * @param {string} orgId 
          * @param {string} requestId 
+         * @param {AcceptJoinRequest} [acceptJoinRequest] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): AxiosPromise<GetJoinAccessRequest200Response> {
-            return localVarFp.acceptJoinAccessRequest(orgId, requestId, options).then((request) => request(axios, basePath));
+        acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig): AxiosPromise<GetJoinAccessRequest200Response> {
+            return localVarFp.acceptJoinAccessRequest(orgId, requestId, acceptJoinRequest, options).then((request) => request(axios, basePath));
         },
         /**
          * Mints an opaque invite token after validating the RMS terminal passport. Call again when a previous token expires to get a new one.
@@ -4420,16 +4883,17 @@ export const JoinAccessApiFactory = function (configuration?: Configuration, bas
  */
 export class JoinAccessApi extends BaseAPI {
     /**
-     * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+     * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
      * @summary Accept a pending join access request
      * @param {string} orgId 
      * @param {string} requestId 
+     * @param {AcceptJoinRequest} [acceptJoinRequest] 
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof JoinAccessApi
      */
-    public acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig) {
-        return JoinAccessApiFp(this.configuration).acceptJoinAccessRequest(orgId, requestId, options).then((request) => request(this.axios, this.basePath));
+    public acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig) {
+        return JoinAccessApiFp(this.configuration).acceptJoinAccessRequest(orgId, requestId, acceptJoinRequest, options).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -4502,24 +4966,20 @@ export class JoinAccessApi extends BaseAPI {
 
 
 /**
- * RoleAssignmentApi - axios parameter creator
+ * PrincipalAccessBlockApi - axios parameter creator
  * @export
  */
-export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Configuration) {
+export const PrincipalAccessBlockApiAxiosParamCreator = function (configuration?: Configuration) {
     return {
         /**
-         * Apply a role assignment for the target user without invoking legacy teammate/Zeus role assignment flows.
-         * @summary Apply role assignment
-         * @param {string} orgId 
-         * @param {RoleAssignmentRequestBody} [roleAssignmentRequestBody] 
+         * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+         * @summary Block principal access
+         * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        applyRoleAssignment: async (orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'orgId' is not null or undefined
-            assertParamExists('applyRoleAssignment', 'orgId', orgId)
-            const localVarPath = `/orgs/{orgId}/roleAssignments/apply`
-                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+        blockPrincipalAccess: async (blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/principals/block`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -4541,7 +5001,7 @@ export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Conf
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(roleAssignmentRequestBody, localVarRequestOptions, configuration)
+            localVarRequestOptions.data = serializeDataIfNeeded(blockPrincipalAccessRequest, localVarRequestOptions, configuration)
 
             return {
                 url: toPathString(localVarUrlObj),
@@ -4549,18 +5009,19 @@ export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Conf
             };
         },
         /**
-         * Rematerializes a role assignment and applies the resulting policy assignments
-         * @summary Rematerialize Role Assignment
-         * @param {string} orgId 
-         * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody] 
+         * Get the current access block for a principal. Requires BlockPrincipalAccess.
+         * @summary Get principal access block
+         * @param {GetPrincipalAccessBlockTypeEnum} type 
+         * @param {string} id 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        rematerializeRoleAssignmentV2: async (orgId: string, rematerializeRoleAssignmentRequestBody?: RematerializeRoleAssignmentRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'orgId' is not null or undefined
-            assertParamExists('rematerializeRoleAssignmentV2', 'orgId', orgId)
-            const localVarPath = `/orgs/{orgId}/roleAssignments/rematerialize`
-                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+        getPrincipalAccessBlock: async (type: GetPrincipalAccessBlockTypeEnum, id: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'type' is not null or undefined
+            assertParamExists('getPrincipalAccessBlock', 'type', type)
+            // verify required parameter 'id' is not null or undefined
+            assertParamExists('getPrincipalAccessBlock', 'id', id)
+            const localVarPath = `/principals/block`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -4568,21 +5029,26 @@ export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Conf
                 baseOptions = configuration.baseOptions;
             }
 
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
             const localVarHeaderParameter = {} as any;
             const localVarQueryParameter = {} as any;
 
             // authentication ApiKeyAuth required
             await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
 
+            if (type !== undefined) {
+                localVarQueryParameter['type'] = type;
+            }
+
+            if (id !== undefined) {
+                localVarQueryParameter['id'] = id;
+            }
 
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
 
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(rematerializeRoleAssignmentRequestBody, localVarRequestOptions, configuration)
 
             return {
                 url: toPathString(localVarUrlObj),
@@ -4590,18 +5056,14 @@ export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Conf
             };
         },
         /**
-         * Revokes all V2 role assignments for the teammate in this org, reconciles away their policies, and removes them from the org user list. Does not delete the teammate account in Zeus.
-         * @summary Remove teammate
-         * @param {string} orgId 
-         * @param {RemoveTeammateRequestBody} [removeTeammateRequestBody] 
+         * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+         * @summary List principal access blocks
+         * @param {ListPrincipalAccessBlocksTypeEnum} [type] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        removeTeammate: async (orgId: string, removeTeammateRequestBody?: RemoveTeammateRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'orgId' is not null or undefined
-            assertParamExists('removeTeammate', 'orgId', orgId)
-            const localVarPath = `/orgs/{orgId}/roleAssignments/remove`
-                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+        listPrincipalAccessBlocks: async (type?: ListPrincipalAccessBlocksTypeEnum, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/principals/blocks`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -4609,53 +5071,416 @@ export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Conf
                 baseOptions = configuration.baseOptions;
             }
 
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
             const localVarHeaderParameter = {} as any;
             const localVarQueryParameter = {} as any;
 
             // authentication ApiKeyAuth required
             await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
 
+            if (type !== undefined) {
+                localVarQueryParameter['type'] = type;
+            }
+
 
     
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(removeTeammateRequestBody, localVarRequestOptions, configuration)
 
             return {
                 url: toPathString(localVarUrlObj),
                 options: localVarRequestOptions,
             };
         },
-    }
-};
-
-/**
- * RoleAssignmentApi - functional programming interface
- * @export
- */
-export const RoleAssignmentApiFp = function(configuration?: Configuration) {
-    const localVarAxiosParamCreator = RoleAssignmentApiAxiosParamCreator(configuration)
-    return {
         /**
-         * Apply a role assignment for the target user without invoking legacy teammate/Zeus role assignment flows.
-         * @summary Apply role assignment
-         * @param {string} orgId 
-         * @param {RoleAssignmentRequestBody} [roleAssignmentRequestBody] 
+         * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+         * @summary Unblock principal access
+         * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        async applyRoleAssignment(orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<RoleAssignmentSuccessResponse>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.applyRoleAssignment(orgId, roleAssignmentRequestBody, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['RoleAssignmentApi.applyRoleAssignment']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
+        unblockPrincipalAccess: async (unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/principals/unblock`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(unblockPrincipalAccessRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * PrincipalAccessBlockApi - functional programming interface
+ * @export
+ */
+export const PrincipalAccessBlockApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = PrincipalAccessBlockApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+         * @summary Block principal access
+         * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccessBlockStateResponseBlocked>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.blockPrincipalAccess(blockPrincipalAccessRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PrincipalAccessBlockApi.blockPrincipalAccess']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Get the current access block for a principal. Requires BlockPrincipalAccess.
+         * @summary Get principal access block
+         * @param {GetPrincipalAccessBlockTypeEnum} type 
+         * @param {string} id 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccessBlockStateResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getPrincipalAccessBlock(type, id, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PrincipalAccessBlockApi.getPrincipalAccessBlock']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+         * @summary List principal access blocks
+         * @param {ListPrincipalAccessBlocksTypeEnum} [type] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListPrincipalAccessBlocksResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listPrincipalAccessBlocks(type, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PrincipalAccessBlockApi.listPrincipalAccessBlocks']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+         * @summary Unblock principal access
+         * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<UnblockPrincipalAccessResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.unblockPrincipalAccess(unblockPrincipalAccessRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PrincipalAccessBlockApi.unblockPrincipalAccess']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * PrincipalAccessBlockApi - factory interface
+ * @export
+ */
+export const PrincipalAccessBlockApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = PrincipalAccessBlockApiFp(configuration)
+    return {
+        /**
+         * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+         * @summary Block principal access
+         * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccessBlockStateResponseBlocked> {
+            return localVarFp.blockPrincipalAccess(blockPrincipalAccessRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Get the current access block for a principal. Requires BlockPrincipalAccess.
+         * @summary Get principal access block
+         * @param {GetPrincipalAccessBlockTypeEnum} type 
+         * @param {string} id 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig): AxiosPromise<AccessBlockStateResponse> {
+            return localVarFp.getPrincipalAccessBlock(type, id, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+         * @summary List principal access blocks
+         * @param {ListPrincipalAccessBlocksTypeEnum} [type] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig): AxiosPromise<ListPrincipalAccessBlocksResponse> {
+            return localVarFp.listPrincipalAccessBlocks(type, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+         * @summary Unblock principal access
+         * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig): AxiosPromise<UnblockPrincipalAccessResponse> {
+            return localVarFp.unblockPrincipalAccess(unblockPrincipalAccessRequest, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * PrincipalAccessBlockApi - object-oriented interface
+ * @export
+ * @class PrincipalAccessBlockApi
+ * @extends {BaseAPI}
+ */
+export class PrincipalAccessBlockApi extends BaseAPI {
+    /**
+     * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+     * @summary Block principal access
+     * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    public blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig) {
+        return PrincipalAccessBlockApiFp(this.configuration).blockPrincipalAccess(blockPrincipalAccessRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Get the current access block for a principal. Requires BlockPrincipalAccess.
+     * @summary Get principal access block
+     * @param {GetPrincipalAccessBlockTypeEnum} type 
+     * @param {string} id 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    public getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig) {
+        return PrincipalAccessBlockApiFp(this.configuration).getPrincipalAccessBlock(type, id, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+     * @summary List principal access blocks
+     * @param {ListPrincipalAccessBlocksTypeEnum} [type] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    public listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig) {
+        return PrincipalAccessBlockApiFp(this.configuration).listPrincipalAccessBlocks(type, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+     * @summary Unblock principal access
+     * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    public unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig) {
+        return PrincipalAccessBlockApiFp(this.configuration).unblockPrincipalAccess(unblockPrincipalAccessRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
+/**
+ * @export
+ */
+export const GetPrincipalAccessBlockTypeEnum = {
+    User: 'User',
+    Automation: 'Automation',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
+export type GetPrincipalAccessBlockTypeEnum = typeof GetPrincipalAccessBlockTypeEnum[keyof typeof GetPrincipalAccessBlockTypeEnum];
+/**
+ * @export
+ */
+export const ListPrincipalAccessBlocksTypeEnum = {
+    User: 'User',
+    Automation: 'Automation',
+    Kiosk: 'Kiosk',
+    Terminal: 'Terminal'
+} as const;
+export type ListPrincipalAccessBlocksTypeEnum = typeof ListPrincipalAccessBlocksTypeEnum[keyof typeof ListPrincipalAccessBlocksTypeEnum];
+
+
+/**
+ * RoleAssignmentApi - axios parameter creator
+ * @export
+ */
+export const RoleAssignmentApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
         /**
-         * Rematerializes a role assignment and applies the resulting policy assignments
+         * Apply a role assignment for the target user without invoking legacy teammate/Zeus role assignment flows.
+         * @summary Apply role assignment
+         * @param {string} orgId 
+         * @param {RoleAssignmentRequestBody} [roleAssignmentRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyRoleAssignment: async (orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('applyRoleAssignment', 'orgId', orgId)
+            const localVarPath = `/orgs/{orgId}/roleAssignments/apply`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(roleAssignmentRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
+         * @summary Rematerialize Role Assignment
+         * @param {string} orgId 
+         * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        rematerializeRoleAssignmentV2: async (orgId: string, rematerializeRoleAssignmentRequestBody?: RematerializeRoleAssignmentRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('rematerializeRoleAssignmentV2', 'orgId', orgId)
+            const localVarPath = `/orgs/{orgId}/roleAssignments/rematerialize`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(rematerializeRoleAssignmentRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Revokes all V2 role assignments for the teammate in this org, reconciles away their policies, and removes them from the org user list. Does not delete the teammate account in Zeus.
+         * @summary Remove teammate
+         * @param {string} orgId 
+         * @param {RemoveTeammateRequestBody} [removeTeammateRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeTeammate: async (orgId: string, removeTeammateRequestBody?: RemoveTeammateRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('removeTeammate', 'orgId', orgId)
+            const localVarPath = `/orgs/{orgId}/roleAssignments/remove`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(removeTeammateRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * RoleAssignmentApi - functional programming interface
+ * @export
+ */
+export const RoleAssignmentApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = RoleAssignmentApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Apply a role assignment for the target user without invoking legacy teammate/Zeus role assignment flows.
+         * @summary Apply role assignment
+         * @param {string} orgId 
+         * @param {RoleAssignmentRequestBody} [roleAssignmentRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async applyRoleAssignment(orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<RoleAssignmentSuccessResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.applyRoleAssignment(orgId, roleAssignmentRequestBody, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RoleAssignmentApi.applyRoleAssignment']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
          * @summary Rematerialize Role Assignment
          * @param {string} orgId 
          * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody] 
@@ -4704,7 +5529,7 @@ export const RoleAssignmentApiFactory = function (configuration?: Configuration,
             return localVarFp.applyRoleAssignment(orgId, roleAssignmentRequestBody, options).then((request) => request(axios, basePath));
         },
         /**
-         * Rematerializes a role assignment and applies the resulting policy assignments
+         * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
          * @summary Rematerialize Role Assignment
          * @param {string} orgId 
          * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody] 
@@ -4749,7 +5574,7 @@ export class RoleAssignmentApi extends BaseAPI {
     }
 
     /**
-     * Rematerializes a role assignment and applies the resulting policy assignments
+     * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
      * @summary Rematerialize Role Assignment
      * @param {string} orgId 
      * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody] 
@@ -4777,6 +5602,211 @@ export class RoleAssignmentApi extends BaseAPI {
 
 
 
+/**
+ * TimedAccessApi - axios parameter creator
+ * @export
+ */
+export const TimedAccessApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+         * @summary Create a timed access pass
+         * @param {string} orgId 
+         * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createTimedAccessGrant: async (orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('createTimedAccessGrant', 'orgId', orgId)
+            const localVarPath = `/timedAccess/orgs/{orgId}/grants`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(timedAccessGrantRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Returns the authenticated caller\'s active pass for the requested org.
+         * @summary List the caller\'s active timed access pass for an org
+         * @param {string} orgId 
+         * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listMyTimedAccessGrants: async (orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('listMyTimedAccessGrants', 'orgId', orgId)
+            const localVarPath = `/timedAccess/orgs/{orgId}/grants`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (status !== undefined) {
+                localVarQueryParameter['status'] = status;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * TimedAccessApi - functional programming interface
+ * @export
+ */
+export const TimedAccessApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = TimedAccessApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+         * @summary Create a timed access pass
+         * @param {string} orgId 
+         * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<TimedAccessGrantResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['TimedAccessApi.createTimedAccessGrant']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Returns the authenticated caller\'s active pass for the requested org.
+         * @summary List the caller\'s active timed access pass for an org
+         * @param {string} orgId 
+         * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListTimedAccessGrantsResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listMyTimedAccessGrants(orgId, status, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['TimedAccessApi.listMyTimedAccessGrants']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * TimedAccessApi - factory interface
+ * @export
+ */
+export const TimedAccessApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = TimedAccessApiFp(configuration)
+    return {
+        /**
+         * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+         * @summary Create a timed access pass
+         * @param {string} orgId 
+         * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<TimedAccessGrantResponse> {
+            return localVarFp.createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Returns the authenticated caller\'s active pass for the requested org.
+         * @summary List the caller\'s active timed access pass for an org
+         * @param {string} orgId 
+         * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig): AxiosPromise<ListTimedAccessGrantsResponse> {
+            return localVarFp.listMyTimedAccessGrants(orgId, status, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * TimedAccessApi - object-oriented interface
+ * @export
+ * @class TimedAccessApi
+ * @extends {BaseAPI}
+ */
+export class TimedAccessApi extends BaseAPI {
+    /**
+     * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+     * @summary Create a timed access pass
+     * @param {string} orgId 
+     * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    public createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig) {
+        return TimedAccessApiFp(this.configuration).createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Returns the authenticated caller\'s active pass for the requested org.
+     * @summary List the caller\'s active timed access pass for an org
+     * @param {string} orgId 
+     * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    public listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig) {
+        return TimedAccessApiFp(this.configuration).listMyTimedAccessGrants(orgId, status, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
+/**
+ * @export
+ */
+export const ListMyTimedAccessGrantsStatusEnum = {
+    Active: 'active'
+} as const;
+export type ListMyTimedAccessGrantsStatusEnum = typeof ListMyTimedAccessGrantsStatusEnum[keyof typeof ListMyTimedAccessGrantsStatusEnum];
+
+
 /**
  * UserManagementApi - axios parameter creator
  * @export