@flipdish/authorization 0.2.54 → 0.2.55

package/api.ts

@@ -281,6 +281,27 @@ export const AccessRequestResponseRoleNameEnum = {
 
 export type AccessRequestResponseRoleNameEnum = typeof AccessRequestResponseRoleNameEnum[keyof typeof AccessRequestResponseRoleNameEnum];
 
+/**
+ * 
+ * @export
+ * @interface ApplyNamedRoleRequestBody
+ */
+export interface ApplyNamedRoleRequestBody {
+    /**
+     * The user receiving the role
+     * @type {string}
+     * @memberof ApplyNamedRoleRequestBody
+     */
+    'userId': string;
+    /**
+     * 
+     * @type {RoleNames}
+     * @memberof ApplyNamedRoleRequestBody
+     */
+    'roleName': RoleNames;
+}
+
+
 /**
  * Request to check if a user is authorized to perform an action(s). If you pass in an array of permissions, you will receive a single allow / deny response (based on an AND of the result for each permission). For a granular response to multiple permissions, call the /authorize/batch endpoint. 
  * @export
@@ -965,10 +986,10 @@ export interface CreateGlobalApiKeyRequest {
     'permissions': Array<string>;
     /**
      * 
-     * @type {Array<AuthorizationRequestResource>}
+     * @type {CreateGlobalApiKeyRequestResource}
      * @memberof CreateGlobalApiKeyRequest
      */
-    'resources'?: Array<AuthorizationRequestResource>;
+    'resource'?: CreateGlobalApiKeyRequestResource;
     /**
      * 
      * @type {boolean}
@@ -988,6 +1009,13 @@ export interface CreateGlobalApiKeyRequest {
      */
     'orgId'?: string;
 }
+/**
+ * @type CreateGlobalApiKeyRequestResource
+ * Single resource the key is scoped to (required when global is false)
+ * @export
+ */
+export type CreateGlobalApiKeyRequestResource = AuthorizationRequestResourceOneOf | AuthorizationRequestResourceOneOf1 | AuthorizationRequestResourceOneOf2 | AuthorizationRequestResourceOneOf3;
+
 /**
  * 
  * @export
@@ -1840,6 +1868,25 @@ export const JoinAccessErrorResponseCodeEnum = {
 
 export type JoinAccessErrorResponseCodeEnum = typeof JoinAccessErrorResponseCodeEnum[keyof typeof JoinAccessErrorResponseCodeEnum];
 
+/**
+ * An org\'s expired timed access grants, most recent first
+ * @export
+ * @interface ListExpiredTimedAccessGrantsResponse
+ */
+export interface ListExpiredTimedAccessGrantsResponse {
+    /**
+     * 
+     * @type {Array<TimedAccessGrant>}
+     * @memberof ListExpiredTimedAccessGrantsResponse
+     */
+    'grants': Array<TimedAccessGrant>;
+    /**
+     * Pass as the cursor query param to fetch the next page. Absent on the last page
+     * @type {string}
+     * @memberof ListExpiredTimedAccessGrantsResponse
+     */
+    'nextCursor'?: string;
+}
 /**
  * 
  * @export
@@ -2075,6 +2122,39 @@ export interface ListTimedAccessGrantsResponse {
      */
     'grants': Array<TimedAccessGrant>;
 }
+/**
+ * The named role assignment
+ * @export
+ * @interface NamedRoleAssignmentResponse
+ */
+export interface NamedRoleAssignmentResponse {
+    /**
+     * 
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'userId': string;
+    /**
+     * Best-effort; omitted if the principal has no known email on file
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'email'?: string;
+    /**
+     * 
+     * @type {RoleNames}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'role': RoleNames;
+    /**
+     * 
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'assignedAt': string;
+}
+
+
 /**
  * Permissions
  * @export
@@ -2209,6 +2289,7 @@ export const Permissions = {
     ViewUserEventsAuditLogs: 'ViewUserEventsAuditLogs',
     ViewCampaignsAuditLogs: 'ViewCampaignsAuditLogs',
     ViewTeammatesAuditLogs: 'ViewTeammatesAuditLogs',
+    ViewTimedAccessAuditLogs: 'ViewTimedAccessAuditLogs',
     ViewAppAuditLogs: 'ViewAppAuditLogs',
     ViewCustomerAuditLogs: 'ViewCustomerAuditLogs',
     ViewPrinterAuditLogs: 'ViewPrinterAuditLogs',
@@ -2491,6 +2572,27 @@ export interface RematerializeRoleAssignmentSuccessResponseRoleAssignment {
      */
     'assignmentId': string;
 }
+/**
+ * 
+ * @export
+ * @interface RemoveNamedRoleRequestBody
+ */
+export interface RemoveNamedRoleRequestBody {
+    /**
+     * The user losing the role
+     * @type {string}
+     * @memberof RemoveNamedRoleRequestBody
+     */
+    'userId': string;
+    /**
+     * 
+     * @type {RoleNames}
+     * @memberof RemoveNamedRoleRequestBody
+     */
+    'roleName': RoleNames;
+}
+
+
 /**
  * 
  * @export
@@ -3174,10 +3276,10 @@ export interface UpdateGlobalApiKeyRequest {
     'permissions'?: Array<string>;
     /**
      * 
-     * @type {Array<AuthorizationRequestResource>}
+     * @type {AuthorizationRequestResource}
      * @memberof UpdateGlobalApiKeyRequest
      */
-    'resources'?: Array<AuthorizationRequestResource>;
+    'resource'?: AuthorizationRequestResource;
     /**
      * 
      * @type {boolean}
@@ -5283,6 +5385,189 @@ export class JoinAccessApi extends BaseAPI {
 
 
 
+/**
+ * NamedRolesApi - axios parameter creator
+ * @export
+ */
+export const NamedRolesApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyNamedRole: async (applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/namedRoles/apply`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(applyNamedRoleRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeNamedRole: async (removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/namedRoles/remove`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(removeNamedRoleRequestBody, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * NamedRolesApi - functional programming interface
+ * @export
+ */
+export const NamedRolesApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = NamedRolesApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<NamedRoleAssignmentResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.applyNamedRole(applyNamedRoleRequestBody, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['NamedRolesApi.applyNamedRole']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.removeNamedRole(removeNamedRoleRequestBody, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['NamedRolesApi.removeNamedRole']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * NamedRolesApi - factory interface
+ * @export
+ */
+export const NamedRolesApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = NamedRolesApiFp(configuration)
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<NamedRoleAssignmentResponse> {
+            return localVarFp.applyNamedRole(applyNamedRoleRequestBody, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.removeNamedRole(removeNamedRoleRequestBody, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * NamedRolesApi - object-oriented interface
+ * @export
+ * @class NamedRolesApi
+ * @extends {BaseAPI}
+ */
+export class NamedRolesApi extends BaseAPI {
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    public applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig) {
+        return NamedRolesApiFp(this.configuration).applyNamedRole(applyNamedRoleRequestBody, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    public removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig) {
+        return NamedRolesApiFp(this.configuration).removeNamedRole(removeNamedRoleRequestBody, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
+
+
 /**
  * PrincipalAccessBlockApi - axios parameter creator
  * @export
@@ -5937,7 +6222,7 @@ export const TimedAccessApiAxiosParamCreator = function (configuration?: Configu
         createTimedAccessGrant: async (orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'orgId' is not null or undefined
             assertParamExists('createTimedAccessGrant', 'orgId', orgId)
-            const localVarPath = `/timedAccess/orgs/{orgId}/grants`
+            const localVarPath = `/orgs/{orgId}/timedAccess/grants`
                 .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
@@ -5967,6 +6252,53 @@ export const TimedAccessApiAxiosParamCreator = function (configuration?: Configu
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId 
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listExpiredTimedAccessGrantsForOrg: async (orgId: string, limit?: number, cursor?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'orgId' is not null or undefined
+            assertParamExists('listExpiredTimedAccessGrantsForOrg', 'orgId', orgId)
+            const localVarPath = `/orgs/{orgId}/timedAccess/grants/expired`
+                .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication ApiKeyAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (limit !== undefined) {
+                localVarQueryParameter['limit'] = limit;
+            }
+
+            if (cursor !== undefined) {
+                localVarQueryParameter['cursor'] = cursor;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -5978,7 +6310,7 @@ export const TimedAccessApiAxiosParamCreator = function (configuration?: Configu
         listMyTimedAccessGrants: async (orgId: string, status?: ListMyTimedAccessGrantsStatusEnum, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'orgId' is not null or undefined
             assertParamExists('listMyTimedAccessGrants', 'orgId', orgId)
-            const localVarPath = `/timedAccess/orgs/{orgId}/grants`
+            const localVarPath = `/orgs/{orgId}/timedAccess/grants`
                 .replace(`{${"orgId"}}`, encodeURIComponent(String(orgId)));
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
@@ -6033,6 +6365,21 @@ export const TimedAccessApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['TimedAccessApi.createTimedAccessGrant']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId 
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListExpiredTimedAccessGrantsResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['TimedAccessApi.listExpiredTimedAccessGrantsForOrg']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -6068,6 +6415,18 @@ export const TimedAccessApiFactory = function (configuration?: Configuration, ba
         createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<TimedAccessGrantResponse> {
             return localVarFp.createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId 
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): AxiosPromise<ListExpiredTimedAccessGrantsResponse> {
+            return localVarFp.listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options).then((request) => request(axios, basePath));
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -6102,6 +6461,20 @@ export class TimedAccessApi extends BaseAPI {
         return TimedAccessApiFp(this.configuration).createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId 
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    public listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig) {
+        return TimedAccessApiFp(this.configuration).listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org

package/configuration.ts

@@ -100,7 +100,7 @@ export class Configuration {
 
         const extraHeaders =  param.useDefaultUserAgent ? {} : { 
             headers: {
-                "user-agent": "Flipdish authorization typescript SDK / 0.2.54"
+                "user-agent": "Flipdish authorization typescript SDK / 0.2.55"
             }
         };
 

package/dist/api.d.ts

@@ -261,6 +261,25 @@ export declare const AccessRequestResponseRoleNameEnum: {
     readonly Terminal: "Terminal";
 };
 export type AccessRequestResponseRoleNameEnum = typeof AccessRequestResponseRoleNameEnum[keyof typeof AccessRequestResponseRoleNameEnum];
+/**
+ *
+ * @export
+ * @interface ApplyNamedRoleRequestBody
+ */
+export interface ApplyNamedRoleRequestBody {
+    /**
+     * The user receiving the role
+     * @type {string}
+     * @memberof ApplyNamedRoleRequestBody
+     */
+    'userId': string;
+    /**
+     *
+     * @type {RoleNames}
+     * @memberof ApplyNamedRoleRequestBody
+     */
+    'roleName': RoleNames;
+}
 /**
  * Request to check if a user is authorized to perform an action(s). If you pass in an array of permissions, you will receive a single allow / deny response (based on an AND of the result for each permission). For a granular response to multiple permissions, call the /authorize/batch endpoint.
  * @export
@@ -911,10 +930,10 @@ export interface CreateGlobalApiKeyRequest {
     'permissions': Array<string>;
     /**
      *
-     * @type {Array<AuthorizationRequestResource>}
+     * @type {CreateGlobalApiKeyRequestResource}
      * @memberof CreateGlobalApiKeyRequest
      */
-    'resources'?: Array<AuthorizationRequestResource>;
+    'resource'?: CreateGlobalApiKeyRequestResource;
     /**
      *
      * @type {boolean}
@@ -934,6 +953,12 @@ export interface CreateGlobalApiKeyRequest {
      */
     'orgId'?: string;
 }
+/**
+ * @type CreateGlobalApiKeyRequestResource
+ * Single resource the key is scoped to (required when global is false)
+ * @export
+ */
+export type CreateGlobalApiKeyRequestResource = AuthorizationRequestResourceOneOf | AuthorizationRequestResourceOneOf1 | AuthorizationRequestResourceOneOf2 | AuthorizationRequestResourceOneOf3;
 /**
  *
  * @export
@@ -1760,6 +1785,25 @@ export declare const JoinAccessErrorResponseCodeEnum: {
     readonly AlreadyMember: "ALREADY_MEMBER";
 };
 export type JoinAccessErrorResponseCodeEnum = typeof JoinAccessErrorResponseCodeEnum[keyof typeof JoinAccessErrorResponseCodeEnum];
+/**
+ * An org\'s expired timed access grants, most recent first
+ * @export
+ * @interface ListExpiredTimedAccessGrantsResponse
+ */
+export interface ListExpiredTimedAccessGrantsResponse {
+    /**
+     *
+     * @type {Array<TimedAccessGrant>}
+     * @memberof ListExpiredTimedAccessGrantsResponse
+     */
+    'grants': Array<TimedAccessGrant>;
+    /**
+     * Pass as the cursor query param to fetch the next page. Absent on the last page
+     * @type {string}
+     * @memberof ListExpiredTimedAccessGrantsResponse
+     */
+    'nextCursor'?: string;
+}
 /**
  *
  * @export
@@ -1989,6 +2033,37 @@ export interface ListTimedAccessGrantsResponse {
      */
     'grants': Array<TimedAccessGrant>;
 }
+/**
+ * The named role assignment
+ * @export
+ * @interface NamedRoleAssignmentResponse
+ */
+export interface NamedRoleAssignmentResponse {
+    /**
+     *
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'userId': string;
+    /**
+     * Best-effort; omitted if the principal has no known email on file
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'email'?: string;
+    /**
+     *
+     * @type {RoleNames}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'role': RoleNames;
+    /**
+     *
+     * @type {string}
+     * @memberof NamedRoleAssignmentResponse
+     */
+    'assignedAt': string;
+}
 /**
  * Permissions
  * @export
@@ -2122,6 +2197,7 @@ export declare const Permissions: {
     readonly ViewUserEventsAuditLogs: "ViewUserEventsAuditLogs";
     readonly ViewCampaignsAuditLogs: "ViewCampaignsAuditLogs";
     readonly ViewTeammatesAuditLogs: "ViewTeammatesAuditLogs";
+    readonly ViewTimedAccessAuditLogs: "ViewTimedAccessAuditLogs";
     readonly ViewAppAuditLogs: "ViewAppAuditLogs";
     readonly ViewCustomerAuditLogs: "ViewCustomerAuditLogs";
     readonly ViewPrinterAuditLogs: "ViewPrinterAuditLogs";
@@ -2398,6 +2474,25 @@ export interface RematerializeRoleAssignmentSuccessResponseRoleAssignment {
      */
     'assignmentId': string;
 }
+/**
+ *
+ * @export
+ * @interface RemoveNamedRoleRequestBody
+ */
+export interface RemoveNamedRoleRequestBody {
+    /**
+     * The user losing the role
+     * @type {string}
+     * @memberof RemoveNamedRoleRequestBody
+     */
+    'userId': string;
+    /**
+     *
+     * @type {RoleNames}
+     * @memberof RemoveNamedRoleRequestBody
+     */
+    'roleName': RoleNames;
+}
 /**
  *
  * @export
@@ -3045,10 +3140,10 @@ export interface UpdateGlobalApiKeyRequest {
     'permissions'?: Array<string>;
     /**
      *
-     * @type {Array<AuthorizationRequestResource>}
+     * @type {AuthorizationRequestResource}
      * @memberof UpdateGlobalApiKeyRequest
      */
-    'resources'?: Array<AuthorizationRequestResource>;
+    'resource'?: AuthorizationRequestResource;
     /**
      *
      * @type {boolean}
@@ -4075,6 +4170,98 @@ export declare class JoinAccessApi extends BaseAPI {
      */
     rejectJoinAccessRequest(orgId: string, requestId: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<GetJoinAccessRequest200Response, any, {}, any>>;
 }
+/**
+ * NamedRolesApi - axios parameter creator
+ * @export
+ */
+export declare const NamedRolesApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    applyNamedRole: (applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    removeNamedRole: (removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+};
+/**
+ * NamedRolesApi - functional programming interface
+ * @export
+ */
+export declare const NamedRolesApiFp: (configuration?: Configuration) => {
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<NamedRoleAssignmentResponse>>;
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+};
+/**
+ * NamedRolesApi - factory interface
+ * @export
+ */
+export declare const NamedRolesApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<NamedRoleAssignmentResponse>;
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+};
+/**
+ * NamedRolesApi - object-oriented interface
+ * @export
+ * @class NamedRolesApi
+ * @extends {BaseAPI}
+ */
+export declare class NamedRolesApi extends BaseAPI {
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    applyNamedRole(applyNamedRoleRequestBody?: ApplyNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<NamedRoleAssignmentResponse, any, {}, any>>;
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    removeNamedRole(removeNamedRoleRequestBody?: RemoveNamedRoleRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}, any>>;
+}
 /**
  * PrincipalAccessBlockApi - axios parameter creator
  * @export
@@ -4408,6 +4595,16 @@ export declare const TimedAccessApiAxiosParamCreator: (configuration?: Configura
      * @throws {RequiredError}
      */
     createTimedAccessGrant: (orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listExpiredTimedAccessGrantsForOrg: (orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org
@@ -4432,6 +4629,16 @@ export declare const TimedAccessApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<TimedAccessGrantResponse>>;
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ListExpiredTimedAccessGrantsResponse>>;
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org
@@ -4456,6 +4663,16 @@ export declare const TimedAccessApiFactory: (configuration?: Configuration, base
      * @throws {RequiredError}
      */
     createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): AxiosPromise<TimedAccessGrantResponse>;
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): AxiosPromise<ListExpiredTimedAccessGrantsResponse>;
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org
@@ -4483,6 +4700,17 @@ export declare class TimedAccessApi extends BaseAPI {
      * @memberof TimedAccessApi
      */
     createTimedAccessGrant(orgId: string, timedAccessGrantRequestBody?: TimedAccessGrantRequestBody, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<TimedAccessGrantResponse, any, {}, any>>;
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    listExpiredTimedAccessGrantsForOrg(orgId: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ListExpiredTimedAccessGrantsResponse, any, {}, any>>;
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org

package/dist/api.js

@@ -85,7 +85,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticationApi = exports.AuthenticationApiFactory = exports.AuthenticationApiFp = exports.AuthenticationApiAxiosParamCreator = exports.ListGlobalApiKeysStatusEnum = exports.APIKeysApi = exports.APIKeysApiFactory = exports.APIKeysApiFp = exports.APIKeysApiAxiosParamCreator = exports.UnblockPrincipalAccessResponseStatusEnum = exports.TimedAccessGrantResponseStatusEnum = exports.TimedAccessGrantResponsePrincipalTypeEnum = exports.TimedAccessGrantRequestBodyRoleNameEnum = exports.TimedAccessGrantStatusEnum = exports.TimedAccessGrantPrincipalTypeEnum = exports.RoleNames = exports.RoleLevelDefinitionScopeEnum = exports.RoleAssignmentRequestBodyPrincipalTypeEnum = exports.RoleAssignmentRequestBodyActorTypeEnum = exports.RoleAssignmentRequestBodyRoleNameEnum = exports.RemoveTeammateRequestBodyPrincipalTypeEnum = exports.RemoveTeammateRequestBodyActorTypeEnum = exports.PrincipalInOrgTypeEnum = exports.Permissions = exports.ListRoleDefinitionsSuccessResponseRolesInnerNameEnum = exports.ListOrgRolesSuccessResponseValueRolesEnum = exports.JoinAccessErrorResponseCodeEnum = exports.IsInRoleRequestCheckModeEnum = exports.InviteTokenResponseRoleNameEnum = exports.GlobalApiKeyStateResponseUpdatedStatusEnum = exports.GlobalApiKeyStateResponseRevokedStatusEnum = exports.GlobalApiKeyStateResponseStatusEnum = exports.GetUserPermissionsSuccessResponseResourcesValueResourceTypeEnum = exports.GetJoinAccessRequest200ResponseRoleNameEnum = exports.GetJoinAccessRequest200ResponseStateEnum = exports.GetAuthorizedOrgsRequestPrincipalTypeEnum = exports.AuthorizationRequestResourceOneOf3TypeEnum = exports.AuthorizationRequestResourceOneOf2TypeEnum = exports.AuthorizationRequestResourceOneOf1TypeEnum = exports.AuthorizationRequestResourceOneOfTypeEnum = exports.AuthorizationRequestPrincipalTypeEnum = exports.AuthorizationRequestCheckModeEnum = exports.AuthorizationBatchResponseAllowedResourcesInnerPrincipalTypeEnum = exports.AuthenticateApiKey200ResponseOkEnum = exports.AuthenticateAndCheckIsInRoleRequestCheckModeEnum = exports.AuthenticateAndAuthorizeRequestCheckModeEnum = exports.AccessRequestResponseRoleNameEnum = exports.AccessRequestResponseStateEnum = exports.AccessBlockStateResponseBlockedPrincipalTypeEnum = exports.AcceptJoinRequestRoleNameEnum = void 0;
-exports.UserPermissionsApi = exports.UserPermissionsApiFactory = exports.UserPermissionsApiFp = exports.UserPermissionsApiAxiosParamCreator = exports.UserManagementApi = exports.UserManagementApiFactory = exports.UserManagementApiFp = exports.UserManagementApiAxiosParamCreator = exports.ListMyTimedAccessGrantsStatusEnum = exports.TimedAccessApi = exports.TimedAccessApiFactory = exports.TimedAccessApiFp = exports.TimedAccessApiAxiosParamCreator = exports.RoleAssignmentApi = exports.RoleAssignmentApiFactory = exports.RoleAssignmentApiFp = exports.RoleAssignmentApiAxiosParamCreator = exports.ListPrincipalAccessBlocksTypeEnum = exports.GetPrincipalAccessBlockTypeEnum = exports.PrincipalAccessBlockApi = exports.PrincipalAccessBlockApiFactory = exports.PrincipalAccessBlockApiFp = exports.PrincipalAccessBlockApiAxiosParamCreator = exports.JoinAccessApi = exports.JoinAccessApiFactory = exports.JoinAccessApiFp = exports.JoinAccessApiAxiosParamCreator = exports.ConfigurationDataApi = exports.ConfigurationDataApiFactory = exports.ConfigurationDataApiFp = exports.ConfigurationDataApiAxiosParamCreator = exports.AuthorizedEntitiesApi = exports.AuthorizedEntitiesApiFactory = exports.AuthorizedEntitiesApiFp = exports.AuthorizedEntitiesApiAxiosParamCreator = exports.AuthorizationApi = exports.AuthorizationApiFactory = exports.AuthorizationApiFp = exports.AuthorizationApiAxiosParamCreator = void 0;
+exports.UserPermissionsApi = exports.UserPermissionsApiFactory = exports.UserPermissionsApiFp = exports.UserPermissionsApiAxiosParamCreator = exports.UserManagementApi = exports.UserManagementApiFactory = exports.UserManagementApiFp = exports.UserManagementApiAxiosParamCreator = exports.ListMyTimedAccessGrantsStatusEnum = exports.TimedAccessApi = exports.TimedAccessApiFactory = exports.TimedAccessApiFp = exports.TimedAccessApiAxiosParamCreator = exports.RoleAssignmentApi = exports.RoleAssignmentApiFactory = exports.RoleAssignmentApiFp = exports.RoleAssignmentApiAxiosParamCreator = exports.ListPrincipalAccessBlocksTypeEnum = exports.GetPrincipalAccessBlockTypeEnum = exports.PrincipalAccessBlockApi = exports.PrincipalAccessBlockApiFactory = exports.PrincipalAccessBlockApiFp = exports.PrincipalAccessBlockApiAxiosParamCreator = exports.NamedRolesApi = exports.NamedRolesApiFactory = exports.NamedRolesApiFp = exports.NamedRolesApiAxiosParamCreator = exports.JoinAccessApi = exports.JoinAccessApiFactory = exports.JoinAccessApiFp = exports.JoinAccessApiAxiosParamCreator = exports.ConfigurationDataApi = exports.ConfigurationDataApiFactory = exports.ConfigurationDataApiFp = exports.ConfigurationDataApiAxiosParamCreator = exports.AuthorizedEntitiesApi = exports.AuthorizedEntitiesApiFactory = exports.AuthorizedEntitiesApiFp = exports.AuthorizedEntitiesApiAxiosParamCreator = exports.AuthorizationApi = exports.AuthorizationApiFactory = exports.AuthorizationApiFp = exports.AuthorizationApiAxiosParamCreator = void 0;
 var axios_1 = require("axios");
 // Some imports not used depending on template conditions
 // @ts-ignore
@@ -379,6 +379,7 @@ exports.Permissions = {
     ViewUserEventsAuditLogs: 'ViewUserEventsAuditLogs',
     ViewCampaignsAuditLogs: 'ViewCampaignsAuditLogs',
     ViewTeammatesAuditLogs: 'ViewTeammatesAuditLogs',
+    ViewTimedAccessAuditLogs: 'ViewTimedAccessAuditLogs',
     ViewAppAuditLogs: 'ViewAppAuditLogs',
     ViewCustomerAuditLogs: 'ViewCustomerAuditLogs',
     ViewPrinterAuditLogs: 'ViewPrinterAuditLogs',
@@ -3145,6 +3146,228 @@ var JoinAccessApi = /** @class */ (function (_super) {
     return JoinAccessApi;
 }(base_1.BaseAPI));
 exports.JoinAccessApi = JoinAccessApi;
+/**
+ * NamedRolesApi - axios parameter creator
+ * @export
+ */
+var NamedRolesApiAxiosParamCreator = function (configuration) {
+    var _this = this;
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyNamedRole: function (applyNamedRoleRequestBody_1) {
+            var args_1 = [];
+            for (var _i = 1; _i < arguments.length; _i++) {
+                args_1[_i - 1] = arguments[_i];
+            }
+            return __awaiter(_this, __spreadArray([applyNamedRoleRequestBody_1], args_1, true), void 0, function (applyNamedRoleRequestBody, options) {
+                var localVarPath, localVarUrlObj, baseOptions, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                if (options === void 0) { options = {}; }
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            localVarPath = "/namedRoles/apply";
+                            localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+                            if (configuration) {
+                                baseOptions = configuration.baseOptions;
+                            }
+                            localVarRequestOptions = __assign(__assign({ method: 'POST' }, baseOptions), options);
+                            localVarHeaderParameter = {};
+                            localVarQueryParameter = {};
+                            // authentication ApiKeyAuth required
+                            return [4 /*yield*/, (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration)];
+                        case 1:
+                            // authentication ApiKeyAuth required
+                            _a.sent();
+                            localVarHeaderParameter['Content-Type'] = 'application/json';
+                            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+                            headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+                            localVarRequestOptions.headers = __assign(__assign(__assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+                            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(applyNamedRoleRequestBody, localVarRequestOptions, configuration);
+                            return [2 /*return*/, {
+                                    url: (0, common_1.toPathString)(localVarUrlObj),
+                                    options: localVarRequestOptions,
+                                }];
+                    }
+                });
+            });
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeNamedRole: function (removeNamedRoleRequestBody_1) {
+            var args_1 = [];
+            for (var _i = 1; _i < arguments.length; _i++) {
+                args_1[_i - 1] = arguments[_i];
+            }
+            return __awaiter(_this, __spreadArray([removeNamedRoleRequestBody_1], args_1, true), void 0, function (removeNamedRoleRequestBody, options) {
+                var localVarPath, localVarUrlObj, baseOptions, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                if (options === void 0) { options = {}; }
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            localVarPath = "/namedRoles/remove";
+                            localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+                            if (configuration) {
+                                baseOptions = configuration.baseOptions;
+                            }
+                            localVarRequestOptions = __assign(__assign({ method: 'POST' }, baseOptions), options);
+                            localVarHeaderParameter = {};
+                            localVarQueryParameter = {};
+                            // authentication ApiKeyAuth required
+                            return [4 /*yield*/, (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration)];
+                        case 1:
+                            // authentication ApiKeyAuth required
+                            _a.sent();
+                            localVarHeaderParameter['Content-Type'] = 'application/json';
+                            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+                            headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+                            localVarRequestOptions.headers = __assign(__assign(__assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+                            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(removeNamedRoleRequestBody, localVarRequestOptions, configuration);
+                            return [2 /*return*/, {
+                                    url: (0, common_1.toPathString)(localVarUrlObj),
+                                    options: localVarRequestOptions,
+                                }];
+                    }
+                });
+            });
+        },
+    };
+};
+exports.NamedRolesApiAxiosParamCreator = NamedRolesApiAxiosParamCreator;
+/**
+ * NamedRolesApi - functional programming interface
+ * @export
+ */
+var NamedRolesApiFp = function (configuration) {
+    var localVarAxiosParamCreator = (0, exports.NamedRolesApiAxiosParamCreator)(configuration);
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyNamedRole: function (applyNamedRoleRequestBody, options) {
+            return __awaiter(this, void 0, void 0, function () {
+                var localVarAxiosArgs, localVarOperationServerIndex, localVarOperationServerBasePath;
+                var _a, _b, _c;
+                return __generator(this, function (_d) {
+                    switch (_d.label) {
+                        case 0: return [4 /*yield*/, localVarAxiosParamCreator.applyNamedRole(applyNamedRoleRequestBody, options)];
+                        case 1:
+                            localVarAxiosArgs = _d.sent();
+                            localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                            localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['NamedRolesApi.applyNamedRole']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                            return [2 /*return*/, function (axios, basePath) { return (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath); }];
+                    }
+                });
+            });
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeNamedRole: function (removeNamedRoleRequestBody, options) {
+            return __awaiter(this, void 0, void 0, function () {
+                var localVarAxiosArgs, localVarOperationServerIndex, localVarOperationServerBasePath;
+                var _a, _b, _c;
+                return __generator(this, function (_d) {
+                    switch (_d.label) {
+                        case 0: return [4 /*yield*/, localVarAxiosParamCreator.removeNamedRole(removeNamedRoleRequestBody, options)];
+                        case 1:
+                            localVarAxiosArgs = _d.sent();
+                            localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                            localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['NamedRolesApi.removeNamedRole']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                            return [2 /*return*/, function (axios, basePath) { return (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath); }];
+                    }
+                });
+            });
+        },
+    };
+};
+exports.NamedRolesApiFp = NamedRolesApiFp;
+/**
+ * NamedRolesApi - factory interface
+ * @export
+ */
+var NamedRolesApiFactory = function (configuration, basePath, axios) {
+    var localVarFp = (0, exports.NamedRolesApiFp)(configuration);
+    return {
+        /**
+         * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+         * @summary Assign a named role
+         * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        applyNamedRole: function (applyNamedRoleRequestBody, options) {
+            return localVarFp.applyNamedRole(applyNamedRoleRequestBody, options).then(function (request) { return request(axios, basePath); });
+        },
+        /**
+         * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+         * @summary Remove a named role
+         * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        removeNamedRole: function (removeNamedRoleRequestBody, options) {
+            return localVarFp.removeNamedRole(removeNamedRoleRequestBody, options).then(function (request) { return request(axios, basePath); });
+        },
+    };
+};
+exports.NamedRolesApiFactory = NamedRolesApiFactory;
+/**
+ * NamedRolesApi - object-oriented interface
+ * @export
+ * @class NamedRolesApi
+ * @extends {BaseAPI}
+ */
+var NamedRolesApi = /** @class */ (function (_super) {
+    __extends(NamedRolesApi, _super);
+    function NamedRolesApi() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    /**
+     * Grants a user the named role given in the body. The caller must themselves hold a named role, and may only assign roles at or below their own privilege level (see NamedRolePrivilegeLevel in auth-config); AuthDeveloper can never be assigned here, it\'s IaC-only. Idempotent: assigning twice returns the same result. Mirrors /orgs/{orgId}/roleAssignments/apply.
+     * @summary Assign a named role
+     * @param {ApplyNamedRoleRequestBody} [applyNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    NamedRolesApi.prototype.applyNamedRole = function (applyNamedRoleRequestBody, options) {
+        var _this = this;
+        return (0, exports.NamedRolesApiFp)(this.configuration).applyNamedRole(applyNamedRoleRequestBody, options).then(function (request) { return request(_this.axios, _this.basePath); });
+    };
+    /**
+     * Removes the named role given in the body so the user can no longer act as it. Does not end passes already held; those run to their own expiry. Subject to the same privilege-level gate and AuthDeveloper block as assignment. Mirrors /orgs/{orgId}/roleAssignments/remove.
+     * @summary Remove a named role
+     * @param {RemoveNamedRoleRequestBody} [removeNamedRoleRequestBody]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof NamedRolesApi
+     */
+    NamedRolesApi.prototype.removeNamedRole = function (removeNamedRoleRequestBody, options) {
+        var _this = this;
+        return (0, exports.NamedRolesApiFp)(this.configuration).removeNamedRole(removeNamedRoleRequestBody, options).then(function (request) { return request(_this.axios, _this.basePath); });
+    };
+    return NamedRolesApi;
+}(base_1.BaseAPI));
+exports.NamedRolesApi = NamedRolesApi;
 /**
  * PrincipalAccessBlockApi - axios parameter creator
  * @export
@@ -3936,7 +4159,7 @@ var TimedAccessApiAxiosParamCreator = function (configuration) {
                         case 0:
                             // verify required parameter 'orgId' is not null or undefined
                             (0, common_1.assertParamExists)('createTimedAccessGrant', 'orgId', orgId);
-                            localVarPath = "/timedAccess/orgs/{orgId}/grants"
+                            localVarPath = "/orgs/{orgId}/timedAccess/grants"
                                 .replace("{".concat("orgId", "}"), encodeURIComponent(String(orgId)));
                             localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
                             if (configuration) {
@@ -3963,6 +4186,59 @@ var TimedAccessApiAxiosParamCreator = function (configuration) {
                 });
             });
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listExpiredTimedAccessGrantsForOrg: function (orgId_1, limit_1, cursor_1) {
+            var args_1 = [];
+            for (var _i = 3; _i < arguments.length; _i++) {
+                args_1[_i - 3] = arguments[_i];
+            }
+            return __awaiter(_this, __spreadArray([orgId_1, limit_1, cursor_1], args_1, true), void 0, function (orgId, limit, cursor, options) {
+                var localVarPath, localVarUrlObj, baseOptions, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                if (options === void 0) { options = {}; }
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            // verify required parameter 'orgId' is not null or undefined
+                            (0, common_1.assertParamExists)('listExpiredTimedAccessGrantsForOrg', 'orgId', orgId);
+                            localVarPath = "/orgs/{orgId}/timedAccess/grants/expired"
+                                .replace("{".concat("orgId", "}"), encodeURIComponent(String(orgId)));
+                            localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+                            if (configuration) {
+                                baseOptions = configuration.baseOptions;
+                            }
+                            localVarRequestOptions = __assign(__assign({ method: 'GET' }, baseOptions), options);
+                            localVarHeaderParameter = {};
+                            localVarQueryParameter = {};
+                            // authentication ApiKeyAuth required
+                            return [4 /*yield*/, (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration)];
+                        case 1:
+                            // authentication ApiKeyAuth required
+                            _a.sent();
+                            if (limit !== undefined) {
+                                localVarQueryParameter['limit'] = limit;
+                            }
+                            if (cursor !== undefined) {
+                                localVarQueryParameter['cursor'] = cursor;
+                            }
+                            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+                            headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+                            localVarRequestOptions.headers = __assign(__assign(__assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+                            return [2 /*return*/, {
+                                    url: (0, common_1.toPathString)(localVarUrlObj),
+                                    options: localVarRequestOptions,
+                                }];
+                    }
+                });
+            });
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -3984,7 +4260,7 @@ var TimedAccessApiAxiosParamCreator = function (configuration) {
                         case 0:
                             // verify required parameter 'orgId' is not null or undefined
                             (0, common_1.assertParamExists)('listMyTimedAccessGrants', 'orgId', orgId);
-                            localVarPath = "/timedAccess/orgs/{orgId}/grants"
+                            localVarPath = "/orgs/{orgId}/timedAccess/grants"
                                 .replace("{".concat("orgId", "}"), encodeURIComponent(String(orgId)));
                             localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
                             if (configuration) {
@@ -4046,6 +4322,31 @@ var TimedAccessApiFp = function (configuration) {
                 });
             });
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listExpiredTimedAccessGrantsForOrg: function (orgId, limit, cursor, options) {
+            return __awaiter(this, void 0, void 0, function () {
+                var localVarAxiosArgs, localVarOperationServerIndex, localVarOperationServerBasePath;
+                var _a, _b, _c;
+                return __generator(this, function (_d) {
+                    switch (_d.label) {
+                        case 0: return [4 /*yield*/, localVarAxiosParamCreator.listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options)];
+                        case 1:
+                            localVarAxiosArgs = _d.sent();
+                            localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                            localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['TimedAccessApi.listExpiredTimedAccessGrantsForOrg']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                            return [2 /*return*/, function (axios, basePath) { return (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath); }];
+                    }
+                });
+            });
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -4091,6 +4392,18 @@ var TimedAccessApiFactory = function (configuration, basePath, axios) {
         createTimedAccessGrant: function (orgId, timedAccessGrantRequestBody, options) {
             return localVarFp.createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then(function (request) { return request(axios, basePath); });
         },
+        /**
+         * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+         * @summary An org\'s expired timed access grant history
+         * @param {string} orgId
+         * @param {number} [limit] Page size, defaults to a server-chosen value
+         * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listExpiredTimedAccessGrantsForOrg: function (orgId, limit, cursor, options) {
+            return localVarFp.listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options).then(function (request) { return request(axios, basePath); });
+        },
         /**
          * Returns the authenticated caller\'s active pass for the requested org.
          * @summary List the caller\'s active timed access pass for an org
@@ -4129,6 +4442,20 @@ var TimedAccessApi = /** @class */ (function (_super) {
         var _this = this;
         return (0, exports.TimedAccessApiFp)(this.configuration).createTimedAccessGrant(orgId, timedAccessGrantRequestBody, options).then(function (request) { return request(_this.axios, _this.basePath); });
     };
+    /**
+     * Returns the org’s expired timed access passes, most recent first. Intended for client-facing visibility into Flipdish staff access to their org, not for the staff member themselves.
+     * @summary An org\'s expired timed access grant history
+     * @param {string} orgId
+     * @param {number} [limit] Page size, defaults to a server-chosen value
+     * @param {string} [cursor] Opaque pagination cursor returned as nextCursor on a previous page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof TimedAccessApi
+     */
+    TimedAccessApi.prototype.listExpiredTimedAccessGrantsForOrg = function (orgId, limit, cursor, options) {
+        var _this = this;
+        return (0, exports.TimedAccessApiFp)(this.configuration).listExpiredTimedAccessGrantsForOrg(orgId, limit, cursor, options).then(function (request) { return request(_this.axios, _this.basePath); });
+    };
     /**
      * Returns the authenticated caller\'s active pass for the requested org.
      * @summary List the caller\'s active timed access pass for an org

package/dist/configuration.js

@@ -36,7 +36,7 @@ var Configuration = /** @class */ (function () {
         this.serverIndex = param.serverIndex;
         var extraHeaders = param.useDefaultUserAgent ? {} : {
             headers: {
-                "user-agent": "Flipdish authorization typescript SDK / 0.2.54"
+                "user-agent": "Flipdish authorization typescript SDK / 0.2.55"
             }
         };
         this.baseOptions = __assign(__assign({}, extraHeaders), param.baseOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flipdish/authorization",
-  "version": "0.2.54",
+  "version": "0.2.55",
   "description": "OpenAPI client for @flipdish/authorization",
   "author": "OpenAPI-Generator Contributors",
   "repository": {