@flipdish/authorization 0.2.51 → 0.2.52

package/dist/api.d.ts

@@ -13,6 +13,144 @@ import type { Configuration } from './configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import type { RequestArgs } from './base';
 import { BaseAPI } from './base';
+/**
+ *
+ * @export
+ * @interface AcceptJoinRequest
+ */
+export interface AcceptJoinRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AcceptJoinRequest
+     */
+    'roleName'?: AcceptJoinRequestRoleNameEnum;
+    /**
+     *
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
+     * @memberof AcceptJoinRequest
+     */
+    'propertyIds'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
+}
+export declare const AcceptJoinRequestRoleNameEnum: {
+    readonly Owner: "Owner";
+    readonly PropertyOwner: "PropertyOwner";
+    readonly ManagedOwner: "ManagedOwner";
+    readonly Integrator: "Integrator";
+    readonly PropertyManager: "PropertyManager";
+    readonly FinanceManager: "FinanceManager";
+    readonly StaffMember: "StaffMember";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type AcceptJoinRequestRoleNameEnum = typeof AcceptJoinRequestRoleNameEnum[keyof typeof AcceptJoinRequestRoleNameEnum];
+/**
+ *
+ * @export
+ * @interface AccessBlockStateResponse
+ */
+export interface AccessBlockStateResponse {
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof AccessBlockStateResponse
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponse
+     */
+    'reason'?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponse
+     */
+    'blockedAt': string;
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedBlockedBy}
+     * @memberof AccessBlockStateResponse
+     */
+    'blockedBy': AccessBlockStateResponseBlockedBlockedBy;
+}
+/**
+ *
+ * @export
+ * @interface AccessBlockStateResponseBlocked
+ */
+export interface AccessBlockStateResponseBlocked {
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'reason'?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'blockedAt': string;
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedBlockedBy}
+     * @memberof AccessBlockStateResponseBlocked
+     */
+    'blockedBy': AccessBlockStateResponseBlockedBlockedBy;
+}
+/**
+ *
+ * @export
+ * @interface AccessBlockStateResponseBlockedBlockedBy
+ */
+export interface AccessBlockStateResponseBlockedBlockedBy {
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedBlockedBy
+     */
+    'principalId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedBlockedBy
+     */
+    'email': string;
+}
+/**
+ *
+ * @export
+ * @interface AccessBlockStateResponseBlockedPrincipal
+ */
+export interface AccessBlockStateResponseBlockedPrincipal {
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedPrincipal
+     */
+    'type': AccessBlockStateResponseBlockedPrincipalTypeEnum;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessBlockStateResponseBlockedPrincipal
+     */
+    'id': string;
+}
+export declare const AccessBlockStateResponseBlockedPrincipalTypeEnum: {
+    readonly User: "User";
+    readonly Automation: "Automation";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type AccessBlockStateResponseBlockedPrincipalTypeEnum = typeof AccessBlockStateResponseBlockedPrincipalTypeEnum[keyof typeof AccessBlockStateResponseBlockedPrincipalTypeEnum];
 /**
  *
  * @export
@@ -43,6 +181,12 @@ export interface AccessRequestResponse {
      * @memberof AccessRequestResponse
      */
     'requesterEmail': string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessRequestResponse
+     */
+    'requesterName'?: string;
     /**
      *
      * @type {string}
@@ -57,10 +201,10 @@ export interface AccessRequestResponse {
     'orgName': string;
     /**
      *
-     * @type {Array<string>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof AccessRequestResponse
      */
-    'propertyIds': Array<string>;
+    'propertyIds': Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      *
      * @type {Array<string>}
@@ -711,6 +855,25 @@ export interface AuthorizeBatchChecks400ResponseAnyOfInner {
  */
 export interface AuthorizeBatchChecks400ResponseAnyOfInnerPathInner {
 }
+/**
+ *
+ * @export
+ * @interface BlockPrincipalAccessRequest
+ */
+export interface BlockPrincipalAccessRequest {
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof BlockPrincipalAccessRequest
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     *
+     * @type {string}
+     * @memberof BlockPrincipalAccessRequest
+     */
+    'reason'?: string;
+}
 /**
  *
  * @export
@@ -1036,6 +1199,12 @@ export interface GetJoinAccessRequest200Response {
      * @memberof GetJoinAccessRequest200Response
      */
     'requesterEmail': string;
+    /**
+     *
+     * @type {string}
+     * @memberof GetJoinAccessRequest200Response
+     */
+    'requesterName'?: string;
     /**
      *
      * @type {string}
@@ -1050,10 +1219,10 @@ export interface GetJoinAccessRequest200Response {
     'orgName': string;
     /**
      *
-     * @type {Array<string>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof GetJoinAccessRequest200Response
      */
-    'propertyIds': Array<string>;
+    'propertyIds': Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      *
      * @type {Array<string>}
@@ -1110,6 +1279,13 @@ export declare const GetJoinAccessRequest200ResponseRoleNameEnum: {
     readonly Terminal: "Terminal";
 };
 export type GetJoinAccessRequest200ResponseRoleNameEnum = typeof GetJoinAccessRequest200ResponseRoleNameEnum[keyof typeof GetJoinAccessRequest200ResponseRoleNameEnum];
+/**
+ *
+ * @export
+ * @interface GetJoinAccessRequest200ResponsePropertyIdsInner
+ */
+export interface GetJoinAccessRequest200ResponsePropertyIdsInner {
+}
 /**
  * Successful user permissions retrieval response
  * @export
@@ -1619,10 +1795,10 @@ export interface ListOrgRolesSuccessResponseValue {
     'optionalPermissionSetKeys'?: Array<string>;
     /**
      * Property IDs, or * for all properties, the roles are scoped to
-     * @type {Array<ListOrgRolesSuccessResponseValuePropertiesInner>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof ListOrgRolesSuccessResponseValue
      */
-    'properties'?: Array<ListOrgRolesSuccessResponseValuePropertiesInner>;
+    'properties'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * Brand IDs, or * for all brands, the roles are scoped to
      * @type {Array<ListOrgRolesSuccessResponseValueBrandsInner>}
@@ -1662,13 +1838,6 @@ export interface ListOrgRolesSuccessResponseValueBrandsInner {
  */
 export interface ListOrgRolesSuccessResponseValueOrgId {
 }
-/**
- *
- * @export
- * @interface ListOrgRolesSuccessResponseValuePropertiesInner
- */
-export interface ListOrgRolesSuccessResponseValuePropertiesInner {
-}
 /**
  *
  * @export
@@ -1689,6 +1858,19 @@ export interface ListPermissionsSuccessResponse {
      */
     'permissions': Permissions & Array<Permissions>;
 }
+/**
+ *
+ * @export
+ * @interface ListPrincipalAccessBlocksResponse
+ */
+export interface ListPrincipalAccessBlocksResponse {
+    /**
+     *
+     * @type {Array<AccessBlockStateResponse>}
+     * @memberof ListPrincipalAccessBlocksResponse
+     */
+    'items': Array<AccessBlockStateResponse>;
+}
 /**
  * Successful roles retrieval response
  * @export
@@ -1702,6 +1884,19 @@ export interface ListRolesSuccessResponse {
      */
     'roles': Array<RoleNames>;
 }
+/**
+ * The caller\'s active timed access grants
+ * @export
+ * @interface ListTimedAccessGrantsResponse
+ */
+export interface ListTimedAccessGrantsResponse {
+    /**
+     *
+     * @type {Array<TimedAccessGrant>}
+     * @memberof ListTimedAccessGrantsResponse
+     */
+    'grants': Array<TimedAccessGrant>;
+}
 /**
  * Permissions
  * @export
@@ -1771,6 +1966,7 @@ export declare const Permissions: {
     readonly ViewMenu: "ViewMenu";
     readonly CreateGlobalApiKey: "CreateGlobalAPIKey";
     readonly ListGlobalApiKeys: "ListGlobalAPIKeys";
+    readonly BlockPrincipalAccess: "BlockPrincipalAccess";
     readonly CreateMenu: "CreateMenu";
     readonly UpdateMenu: "UpdateMenu";
     readonly DeleteMenu: "DeleteMenu";
@@ -2035,7 +2231,7 @@ export interface RematerializeRoleAssignmentRequestBody {
     'sk': string;
 }
 /**
- * Successful role assignment rematerialization response
+ * Successful role assignment rematerialization response (reconcile: add missing + revoke leftovers)
  * @export
  * @interface RematerializeRoleAssignmentSuccessResponse
  */
@@ -2051,44 +2247,19 @@ export interface RematerializeRoleAssignmentSuccessResponse {
      * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'materialized': number;
+    'added': number;
     /**
      *
      * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'applied': number;
+    'revoked': number;
     /**
      *
-     * @type {Array<RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner>}
+     * @type {number}
      * @memberof RematerializeRoleAssignmentSuccessResponse
      */
-    'policyAssignments': Array<RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner>;
-}
-/**
- *
- * @export
- * @interface RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
- */
-export interface RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner {
-    /**
-     *
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'policyId': string;
-    /**
-     *
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'assignmentPk': string;
-    /**
-     *
-     * @type {string}
-     * @memberof RematerializeRoleAssignmentSuccessResponsePolicyAssignmentsInner
-     */
-    'assignmentSk': string;
+    'unchanged': number;
 }
 /**
  *
@@ -2255,10 +2426,10 @@ export interface RoleAssignmentRequestBody {
     'roleName': RoleAssignmentRequestBodyRoleNameEnum;
     /**
      * Property resource ids (e.g. p123) when scoped to properties
-     * @type {Array<ListOrgRolesSuccessResponseValuePropertiesInner>}
+     * @type {Array<GetJoinAccessRequest200ResponsePropertyIdsInner>}
      * @memberof RoleAssignmentRequestBody
      */
-    'properties'?: Array<ListOrgRolesSuccessResponseValuePropertiesInner>;
+    'properties'?: Array<GetJoinAccessRequest200ResponsePropertyIdsInner>;
     /**
      * Brand resource ids (e.g. b123) when scoped to brands
      * @type {Array<ListOrgRolesSuccessResponseValueBrandsInner>}
@@ -2409,6 +2580,272 @@ export declare const RoleNames: {
     readonly FlipdishStaff: "FlipdishStaff";
 };
 export type RoleNames = typeof RoleNames[keyof typeof RoleNames];
+/**
+ * A temporary timed access grant
+ * @export
+ * @interface TimedAccessGrant
+ */
+export interface TimedAccessGrant {
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'grantId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'principalType': TimedAccessGrantPrincipalTypeEnum;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'principalId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'email': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'orgId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'roleName': string;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrant
+     */
+    'propertyIds': Array<string>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrant
+     */
+    'brandIds': Array<string>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrant
+     */
+    'salesChannelIds': Array<string>;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'startsAt': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'expiresAt': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrant
+     */
+    'status': TimedAccessGrantStatusEnum;
+}
+export declare const TimedAccessGrantPrincipalTypeEnum: {
+    readonly User: "User";
+    readonly Automation: "Automation";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type TimedAccessGrantPrincipalTypeEnum = typeof TimedAccessGrantPrincipalTypeEnum[keyof typeof TimedAccessGrantPrincipalTypeEnum];
+export declare const TimedAccessGrantStatusEnum: {
+    readonly Active: "active";
+    readonly Expired: "expired";
+};
+export type TimedAccessGrantStatusEnum = typeof TimedAccessGrantStatusEnum[keyof typeof TimedAccessGrantStatusEnum];
+/**
+ *
+ * @export
+ * @interface TimedAccessGrantRequestBody
+ */
+export interface TimedAccessGrantRequestBody {
+    /**
+     * Must match the authenticated caller
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'userId': string;
+    /**
+     * The org to grant temporary access to
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'orgId': string;
+    /**
+     * Role the pass grants
+     * @type {string}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'roleName': TimedAccessGrantRequestBodyRoleNameEnum;
+    /**
+     * Optional property scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'propertyIds'?: Array<string>;
+    /**
+     * Optional brand scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'brandIds'?: Array<string>;
+    /**
+     * Optional sales channel scope
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantRequestBody
+     */
+    'salesChannelIds'?: Array<string>;
+}
+export declare const TimedAccessGrantRequestBodyRoleNameEnum: {
+    readonly Owner: "Owner";
+};
+export type TimedAccessGrantRequestBodyRoleNameEnum = typeof TimedAccessGrantRequestBodyRoleNameEnum[keyof typeof TimedAccessGrantRequestBodyRoleNameEnum];
+/**
+ * The timed access grant that was created or refreshed
+ * @export
+ * @interface TimedAccessGrantResponse
+ */
+export interface TimedAccessGrantResponse {
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'grantId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'principalType': TimedAccessGrantResponsePrincipalTypeEnum;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'principalId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'email': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'orgId': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'roleName': string;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'propertyIds': Array<string>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'brandIds': Array<string>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof TimedAccessGrantResponse
+     */
+    'salesChannelIds': Array<string>;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'startsAt': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'expiresAt': string;
+    /**
+     *
+     * @type {string}
+     * @memberof TimedAccessGrantResponse
+     */
+    'status': TimedAccessGrantResponseStatusEnum;
+}
+export declare const TimedAccessGrantResponsePrincipalTypeEnum: {
+    readonly User: "User";
+    readonly Automation: "Automation";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type TimedAccessGrantResponsePrincipalTypeEnum = typeof TimedAccessGrantResponsePrincipalTypeEnum[keyof typeof TimedAccessGrantResponsePrincipalTypeEnum];
+export declare const TimedAccessGrantResponseStatusEnum: {
+    readonly Active: "active";
+    readonly Expired: "expired";
+};
+export type TimedAccessGrantResponseStatusEnum = typeof TimedAccessGrantResponseStatusEnum[keyof typeof TimedAccessGrantResponseStatusEnum];
+/**
+ *
+ * @export
+ * @interface UnblockPrincipalAccessRequest
+ */
+export interface UnblockPrincipalAccessRequest {
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof UnblockPrincipalAccessRequest
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+}
+/**
+ *
+ * @export
+ * @interface UnblockPrincipalAccessResponse
+ */
+export interface UnblockPrincipalAccessResponse {
+    /**
+     *
+     * @type {AccessBlockStateResponseBlockedPrincipal}
+     * @memberof UnblockPrincipalAccessResponse
+     */
+    'principal': AccessBlockStateResponseBlockedPrincipal;
+    /**
+     *
+     * @type {string}
+     * @memberof UnblockPrincipalAccessResponse
+     */
+    'status': UnblockPrincipalAccessResponseStatusEnum;
+}
+export declare const UnblockPrincipalAccessResponseStatusEnum: {
+    readonly RestorationInProgress: "restoration_in_progress";
+    readonly NotBlocked: "not_blocked";
+};
+export type UnblockPrincipalAccessResponseStatusEnum = typeof UnblockPrincipalAccessResponseStatusEnum[keyof typeof UnblockPrincipalAccessResponseStatusEnum];
 /**
  *
  * @export
@@ -3151,14 +3588,15 @@ export declare class ConfigurationDataApi extends BaseAPI {
  */
 export declare const JoinAccessApiAxiosParamCreator: (configuration?: Configuration) => {
     /**
-     * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+     * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
      * @summary Accept a pending join access request
      * @param {string} orgId
      * @param {string} requestId
+     * @param {AcceptJoinRequest} [acceptJoinRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    acceptJoinAccessRequest: (orgId: string, requestId: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    acceptJoinAccessRequest: (orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Mints an opaque invite token after validating the RMS terminal passport. Call again when a previous token expires to get a new one.
      * @summary Create an invite token
@@ -3212,14 +3650,15 @@ export declare const JoinAccessApiAxiosParamCreator: (configuration?: Configurat
  */
 export declare const JoinAccessApiFp: (configuration?: Configuration) => {
     /**
-     * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+     * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
      * @summary Accept a pending join access request
      * @param {string} orgId
      * @param {string} requestId
+     * @param {AcceptJoinRequest} [acceptJoinRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetJoinAccessRequest200Response>>;
+    acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetJoinAccessRequest200Response>>;
     /**
      * Mints an opaque invite token after validating the RMS terminal passport. Call again when a previous token expires to get a new one.
      * @summary Create an invite token
@@ -3273,14 +3712,15 @@ export declare const JoinAccessApiFp: (configuration?: Configuration) => {
  */
 export declare const JoinAccessApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
     /**
-     * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+     * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
      * @summary Accept a pending join access request
      * @param {string} orgId
      * @param {string} requestId
+     * @param {AcceptJoinRequest} [acceptJoinRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): AxiosPromise<GetJoinAccessRequest200Response>;
+    acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig): AxiosPromise<GetJoinAccessRequest200Response>;
     /**
      * Mints an opaque invite token after validating the RMS terminal passport. Call again when a previous token expires to get a new one.
      * @summary Create an invite token
@@ -3336,15 +3776,16 @@ export declare const JoinAccessApiFactory: (configuration?: Configuration, baseP
  */
 export declare class JoinAccessApi extends BaseAPI {
     /**
-     * Grants the role stored on the access request (copied from the invite token at create time) via AuthZ V2 role assignment (source join).
+     * Grants access via AuthZ V2 role assignment (source join). Optional body fields override the role and property scope stored on the pending request; omitted fields use the request defaults from the invite token.
      * @summary Accept a pending join access request
      * @param {string} orgId
      * @param {string} requestId
+     * @param {AcceptJoinRequest} [acceptJoinRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof JoinAccessApi
      */
-    acceptJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<GetJoinAccessRequest200Response, any, {}, any>>;
+    acceptJoinAccessRequest(orgId: string, requestId: string, acceptJoinRequest?: AcceptJoinRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<GetJoinAccessRequest200Response, any, {}, any>>;
     /**
      * Mints an opaque invite token after validating the RMS terminal passport. Call again when a previous token expires to get a new one.
      * @summary Create an invite token
@@ -3397,6 +3838,188 @@ export declare class JoinAccessApi extends BaseAPI {
      */
     rejectJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<GetJoinAccessRequest200Response, any, {}, any>>;
 }
+/**
+ * PrincipalAccessBlockApi - axios parameter creator
+ * @export
+ */
+export declare const PrincipalAccessBlockApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+     * @summary Block principal access
+     * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    blockPrincipalAccess: (blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Get the current access block for a principal. Requires BlockPrincipalAccess.
+     * @summary Get principal access block
+     * @param {GetPrincipalAccessBlockTypeEnum} type
+     * @param {string} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getPrincipalAccessBlock: (type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+     * @summary List principal access blocks
+     * @param {ListPrincipalAccessBlocksTypeEnum} [type]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listPrincipalAccessBlocks: (type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+     * @summary Unblock principal access
+     * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    unblockPrincipalAccess: (unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+};
+/**
+ * PrincipalAccessBlockApi - functional programming interface
+ * @export
+ */
+export declare const PrincipalAccessBlockApiFp: (configuration?: Configuration) => {
+    /**
+     * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+     * @summary Block principal access
+     * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccessBlockStateResponseBlocked>>;
+    /**
+     * Get the current access block for a principal. Requires BlockPrincipalAccess.
+     * @summary Get principal access block
+     * @param {GetPrincipalAccessBlockTypeEnum} type
+     * @param {string} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccessBlockStateResponse>>;
+    /**
+     * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+     * @summary List principal access blocks
+     * @param {ListPrincipalAccessBlocksTypeEnum} [type]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListPrincipalAccessBlocksResponse>>;
+    /**
+     * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+     * @summary Unblock principal access
+     * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<UnblockPrincipalAccessResponse>>;
+};
+/**
+ * PrincipalAccessBlockApi - factory interface
+ * @export
+ */
+export declare const PrincipalAccessBlockApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+     * @summary Block principal access
+     * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccessBlockStateResponseBlocked>;
+    /**
+     * Get the current access block for a principal. Requires BlockPrincipalAccess.
+     * @summary Get principal access block
+     * @param {GetPrincipalAccessBlockTypeEnum} type
+     * @param {string} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig): AxiosPromise<AccessBlockStateResponse>;
+    /**
+     * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+     * @summary List principal access blocks
+     * @param {ListPrincipalAccessBlocksTypeEnum} [type]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig): AxiosPromise<ListPrincipalAccessBlocksResponse>;
+    /**
+     * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+     * @summary Unblock principal access
+     * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig): AxiosPromise<UnblockPrincipalAccessResponse>;
+};
+/**
+ * PrincipalAccessBlockApi - object-oriented interface
+ * @export
+ * @class PrincipalAccessBlockApi
+ * @extends {BaseAPI}
+ */
+export declare class PrincipalAccessBlockApi extends BaseAPI {
+    /**
+     * Write an access_block flag and a temporary AVP forbid so authorization checks DENY. Decision-cache bust is delayed like other grant changes. Grant drain/restore runs asynchronously. Authentication still succeeds. Requires BlockPrincipalAccess.
+     * @summary Block principal access
+     * @param {BlockPrincipalAccessRequest} [blockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    blockPrincipalAccess(blockPrincipalAccessRequest?: BlockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<AccessBlockStateResponseBlocked, any, {}, any>>;
+    /**
+     * Get the current access block for a principal. Requires BlockPrincipalAccess.
+     * @summary Get principal access block
+     * @param {GetPrincipalAccessBlockTypeEnum} type
+     * @param {string} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    getPrincipalAccessBlock(type: GetPrincipalAccessBlockTypeEnum, id: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<AccessBlockStateResponse, any, {}, any>>;
+    /**
+     * List currently blocked principals. Optional type filter. Requires BlockPrincipalAccess.
+     * @summary List principal access blocks
+     * @param {ListPrincipalAccessBlocksTypeEnum} [type]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    listPrincipalAccessBlocks(type?: ListPrincipalAccessBlocksTypeEnum, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ListPrincipalAccessBlocksResponse, any, {}, any>>;
+    /**
+     * Start restoring existing role assignments. The access_block flag is removed asynchronously after restoration completes, and authorization remains denied until then. Requires BlockPrincipalAccess.
+     * @summary Unblock principal access
+     * @param {UnblockPrincipalAccessRequest} [unblockPrincipalAccessRequest]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PrincipalAccessBlockApi
+     */
+    unblockPrincipalAccess(unblockPrincipalAccessRequest?: UnblockPrincipalAccessRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<UnblockPrincipalAccessResponse, any, {}, any>>;
+}
+/**
+ * @export
+ */
+export declare const GetPrincipalAccessBlockTypeEnum: {
+    readonly User: "User";
+    readonly Automation: "Automation";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type GetPrincipalAccessBlockTypeEnum = typeof GetPrincipalAccessBlockTypeEnum[keyof typeof GetPrincipalAccessBlockTypeEnum];
+/**
+ * @export
+ */
+export declare const ListPrincipalAccessBlocksTypeEnum: {
+    readonly User: "User";
+    readonly Automation: "Automation";
+    readonly Kiosk: "Kiosk";
+    readonly Terminal: "Terminal";
+};
+export type ListPrincipalAccessBlocksTypeEnum = typeof ListPrincipalAccessBlocksTypeEnum[keyof typeof ListPrincipalAccessBlocksTypeEnum];
 /**
  * RoleAssignmentApi - axios parameter creator
  * @export
@@ -3412,7 +4035,7 @@ export declare const RoleAssignmentApiAxiosParamCreator: (configuration?: Config
      */
     applyRoleAssignment: (orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Rematerializes a role assignment and applies the resulting policy assignments
+     * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
      * @summary Rematerialize Role Assignment
      * @param {string} orgId
      * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody]
@@ -3445,7 +4068,7 @@ export declare const RoleAssignmentApiFp: (configuration?: Configuration) => {
      */
     applyRoleAssignment(orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<RoleAssignmentSuccessResponse>>;
     /**
-     * Rematerializes a role assignment and applies the resulting policy assignments
+     * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
      * @summary Rematerialize Role Assignment
      * @param {string} orgId
      * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody]
@@ -3478,7 +4101,7 @@ export declare const RoleAssignmentApiFactory: (configuration?: Configuration, b
      */
     applyRoleAssignment(orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<RoleAssignmentSuccessResponse>;
     /**
-     * Rematerializes a role assignment and applies the resulting policy assignments
+     * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
      * @summary Rematerialize Role Assignment
      * @param {string} orgId
      * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody]
@@ -3514,7 +4137,7 @@ export declare class RoleAssignmentApi extends BaseAPI {
      */
     applyRoleAssignment(orgId: string, roleAssignmentRequestBody?: RoleAssignmentRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<RoleAssignmentSuccessResponse, any, {}, any>>;
     /**
-     * Rematerializes a role assignment and applies the resulting policy assignments
+     * Reconciles policy assignments for the role assignment principal: creates missing policies and revokes leftovers that materialize no longer emits
      * @summary Rematerialize Role Assignment
      * @param {string} orgId
      * @param {RematerializeRoleAssignmentRequestBody} [rematerializeRoleAssignmentRequestBody]
@@ -3534,6 +4157,113 @@ export declare class RoleAssignmentApi extends BaseAPI {
      */
     removeTeammate(orgId: string, removeTeammateRequestBody?: RemoveTeammateRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<RemoveTeammateSuccessResponse, any, {}, any>>;
 }
+/**
+ * TimedAccessApi - axios parameter creator
+ * @export
+ */
+export declare const TimedAccessApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+     * @summary Create a timed access pass
+     * @param {string} orgId
+     * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    createTimedAccessGrant: (orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Returns the authenticated caller\'s active pass for the requested org.
+     * @summary List the caller\'s active timed access pass for an org
+     * @param {string} orgId
+     * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listMyTimedAccessGrants: (orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+};
+/**
+ * TimedAccessApi - functional programming interface
+ * @export
+ */
+export declare const TimedAccessApiFp: (configuration?: Configuration) => {
+    /**
+     * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+     * @summary Create a timed access pass
+     * @param {string} orgId
+     * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<TimedAccessGrantResponse>>;
+    /**
+     * Returns the authenticated caller\'s active pass for the requested org.
+     * @summary List the caller\'s active timed access pass for an org
+     * @param {string} orgId
+     * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListTimedAccessGrantsResponse>>;
+};
+/**
+ * TimedAccessApi - factory interface
+ * @export
+ */
+export declare const TimedAccessApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+     * @summary Create a timed access pass
+     * @param {string} orgId
+     * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<TimedAccessGrantResponse>;
+    /**
+     * Returns the authenticated caller\'s active pass for the requested org.
+     * @summary List the caller\'s active timed access pass for an org
+     * @param {string} orgId
+     * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig): AxiosPromise<ListTimedAccessGrantsResponse>;
+};
+/**
+ * TimedAccessApi - object-oriented interface
+ * @export
+ * @class TimedAccessApi
+ * @extends {BaseAPI}
+ */
+export declare class TimedAccessApi extends BaseAPI {
+    /**
+     * Grants the authenticated caller temporary Owner access to a single org. Requesting again while a pass is active extends it rather than creating a second one.
+     * @summary Create a timed access pass
+     * @param {string} orgId
+     * @param {TimedAccessGrantRequestBody} [timedAccessGrantRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<TimedAccessGrantResponse, any, {}, any>>;
+    /**
+     * Returns the authenticated caller\'s active pass for the requested org.
+     * @summary List the caller\'s active timed access pass for an org
+     * @param {string} orgId
+     * @param {ListMyTimedAccessGrantsStatusEnum} [status] Only active grants are returned. The caller comes from the auth context
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    listMyTimedAccessGrants(orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ListTimedAccessGrantsResponse, any, {}, any>>;
+}
+/**
+ * @export
+ */
+export declare const ListMyTimedAccessGrantsStatusEnum: {
+    readonly Active: "active";
+};
+export type ListMyTimedAccessGrantsStatusEnum = typeof ListMyTimedAccessGrantsStatusEnum[keyof typeof ListMyTimedAccessGrantsStatusEnum];
 /**
  * UserManagementApi - axios parameter creator
  * @export