@graph8/sdk 0.251.0 → 0.262.0

package/docs/api/settings.md

@@ -0,0 +1,731 @@
+<!-- Generated by sdk/js/scripts/generate-agent-docs.ts from developer-contract/openapi.json. Regenerated on every build. -->
+
+# `g8.api.settings`: Settings
+
+18 operations (6 read, 7 write, 4 destructive, 1 external).
+
+No hand-written client covers this area. Call it through `g8.api.settings.*` as shown below, or by operationId with `g8.api.call(operationId, input)`.
+
+Every example below assumes this setup (server-side, API key):
+
+```ts
+import { g8 } from "@graph8/sdk";
+
+g8.init({ apiKey: process.env.G8_API_KEY! });
+```
+
+Example values are placeholders that match each field's type. Only required fields are shown. Every example is type-checked against the SDK in CI.
+
+Exact TypeScript types for every operation on this page, and every schema they use: [settings.d.ts](settings.d.ts).
+
+## Operations
+
+| Call | HTTP | Tier | Scope | Summary |
+|---|---|---|---|---|
+| [`activateSso`](#op-activatesso) | `POST /api/v1/org/sso/activate` | write | `account:write` | Activate Sso |
+| [`configureOidcSso`](#op-configureoidcsso) | `PUT /api/v1/org/sso/oidc` | write | `account:write` | Configure Oidc Sso |
+| [`configureSamlSso`](#op-configuresamlsso) | `PUT /api/v1/org/sso/saml` | write | `account:write` | Configure Saml Sso |
+| [`deactivateSso`](#op-deactivatesso) | `POST /api/v1/org/sso/deactivate` | destructive | `account:delete` | Deactivate Sso |
+| [`deleteSsoConfig`](#op-deletessoconfig) | `DELETE /api/v1/org/sso` | destructive | `account:delete` | Delete Sso Config |
+| [`getCostSettings`](#op-getcostsettings) | `GET /api/v1/org/settings/cost` | read | `account:read` | Get Cost Settings |
+| [`getDeliverabilityProtection`](#op-getdeliverabilityprotection) | `GET /api/v1/org/settings/deliverability-protection` | read | `account:read` | Get Deliverability Protection |
+| [`getDepartments`](#op-getdepartments) | `GET /api/v1/org/settings/departments` | read | `account:read` | Get Departments |
+| [`getOutboundTracking`](#op-getoutboundtracking) | `GET /api/v1/org/settings/outbound-tracking` | read | `account:read` | Get Outbound Tracking |
+| [`getSsoConfig`](#op-getssoconfig) | `GET /api/v1/org/sso` | read | `account:read` | Get Sso Config |
+| [`getSsoMetadata`](#op-getssometadata) | `GET /api/v1/org/sso/metadata` | read | `account:read` | Get Sso Metadata |
+| [`seedDepartmentDefaults`](#op-seeddepartmentdefaults) | `POST /api/v1/org/settings/departments/seed-defaults` | destructive | `account:delete` | Seed Department Defaults |
+| [`syncSsoConfig`](#op-syncssoconfig) | `POST /api/v1/org/sso/sync` | external | `integrations:run` | Sync Sso Config |
+| [`updateCostSettings`](#op-updatecostsettings) | `PUT /api/v1/org/settings/cost` | write | `account:write` | Update Cost Settings |
+| [`updateDeliverabilityProtection`](#op-updatedeliverabilityprotection) | `PUT /api/v1/org/settings/deliverability-protection` | write | `account:write` | Update Deliverability Protection |
+| [`updateDepartments`](#op-updatedepartments) | `PUT /api/v1/org/settings/departments` | write | `account:write` | Update Departments |
+| [`updateOutboundTracking`](#op-updateoutboundtracking) | `PUT /api/v1/org/settings/outbound-tracking` | write | `account:write` | Update Outbound Tracking |
+| [`updateSsoEnforcement`](#op-updatessoenforcement) | `PUT /api/v1/org/sso/enforcement` | destructive | `account:delete` | Update Sso Enforcement |
+
+---
+
+<a id="op-activatesso"></a>
+
+### `g8.api.settings.activateSso(input?)`
+
+**Activate Sso**
+
+- HTTP: `POST /api/v1/org/sso/activate`
+- operationId: `activate_sso_org_sso_activate_post` (also callable as `g8.api.call("activate_sso_org_sso_activate_post", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Switch SSO on for the org.
+
+Check `/org/sso` first: activating a configuration the identity provider
+has not accepted is how an org locks itself out. Reversible with
+`/deactivate`, which is why this is the lighter of the two.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.activateSso();
+```
+
+---
+
+<a id="op-configureoidcsso"></a>
+
+### `g8.api.settings.configureOidcSso(input)`
+
+**Configure Oidc Sso**
+
+- HTTP: `PUT /api/v1/org/sso/oidc`
+- operationId: `configure_oidc_sso_org_sso_oidc_put` (also callable as `g8.api.call("configure_oidc_sso_org_sso_oidc_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Configure OIDC sign-in. Does NOT switch it on - see `/activate`.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `OIDCConfigRequest` | yes | Request body; fields below. |
+
+Body fields (`OIDCConfigRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.authorize_url` | `string` | yes |  |
+| `body.client_id` | `string` | yes |  |
+| `body.client_secret` | `string` | yes | Stored, never returned by the read endpoint. |
+| `body.provider_name` | `string` | yes | IdP name: okta, azure, google, custom. |
+| `body.token_url` | `string` | yes |  |
+| `body.userinfo_url` | `string` | yes |  |
+| `body.allowed_domains` | `Array<string> \| null` | no |  |
+| `body.require_sso` | `boolean` | no | See the SAML note — set this later. default `false` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.configureOidcSso({
+  body: {
+    authorize_url: "https://example.com",
+    client_id: "id",
+    client_secret: "example",
+    provider_name: "Example",
+    token_url: "https://example.com",
+    userinfo_url: "https://example.com",
+  },
+});
+```
+
+---
+
+<a id="op-configuresamlsso"></a>
+
+### `g8.api.settings.configureSamlSso(input)`
+
+**Configure Saml Sso**
+
+- HTTP: `PUT /api/v1/org/sso/saml`
+- operationId: `configure_saml_sso_org_sso_saml_put` (also callable as `g8.api.call("configure_saml_sso_org_sso_saml_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Configure SAML sign-in. Does NOT switch it on - see `/activate`.
+
+Configuring and activating are separate calls in the app and stay separate
+here, so a half-finished configuration cannot lock anyone out.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `SAMLConfigRequest` | yes | Request body; fields below. |
+
+Body fields (`SAMLConfigRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.idp_certificate` | `string` | yes | X.509 certificate from the IdP, PEM format. |
+| `body.idp_entity_id` | `string` | yes | Identity Provider Entity ID. |
+| `body.idp_sso_url` | `string` | yes | SSO URL from the IdP. |
+| `body.provider_name` | `string` | yes | IdP name: okta, azure, google, onelogin, custom. |
+| `body.allowed_domains` | `Array<string> \| null` | no | Email domains allowed to sign in this way. |
+| `body.require_sso` | `boolean` | no | Make SSO the ONLY way in. False here and set it later with `PUT /org/sso/enforcement` once you have signed in through SSO yourself — that ordering is what stops a lockout. default `false` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.configureSamlSso({
+  body: {
+    idp_certificate: "example",
+    idp_entity_id: "id",
+    idp_sso_url: "https://example.com",
+    provider_name: "Example",
+  },
+});
+```
+
+---
+
+<a id="op-deactivatesso"></a>
+
+### `g8.api.settings.deactivateSso(input?)`
+
+**Deactivate Sso**
+
+- HTTP: `POST /api/v1/org/sso/deactivate`
+- operationId: `deactivate_sso_org_sso_deactivate_post` (also callable as `g8.api.call("deactivate_sso_org_sso_deactivate_post", input)`)
+- Tier: `destructive`: deletes or archives data; confirm with a human before calling
+- API-key scope: `account:delete`
+
+Switch SSO off. THE CONFIGURATION IS KEPT.
+
+Everyone falls back to whatever sign-in they had before SSO. If your org
+has no other sign-in method, this is the call that strands them - check
+before running it from a script.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+// destructive: deletes or archives data; confirm with a human before calling.
+const result = await g8.api.settings.deactivateSso();
+```
+
+---
+
+<a id="op-deletessoconfig"></a>
+
+### `g8.api.settings.deleteSsoConfig(input?)`
+
+**Delete Sso Config**
+
+- HTTP: `DELETE /api/v1/org/sso`
+- operationId: `delete_sso_config_org_sso_delete` (also callable as `g8.api.call("delete_sso_config_org_sso_delete", input)`)
+- Tier: `destructive`: deletes or archives data; confirm with a human before calling
+- API-key scope: `account:delete`
+
+Remove the SSO configuration entirely. NOT REVERSIBLE.
+
+`/deactivate` switches SSO off and keeps the configuration; this throws it
+away, and setting it up again means going back to the identity provider.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+// destructive: deletes or archives data; confirm with a human before calling.
+const result = await g8.api.settings.deleteSsoConfig();
+```
+
+---
+
+<a id="op-getcostsettings"></a>
+
+### `g8.api.settings.getCostSettings(input?)`
+
+**Get Cost Settings**
+
+- HTTP: `GET /api/v1/org/settings/cost`
+- operationId: `get_cost_settings_org_settings_cost_get` (also callable as `g8.api.call("get_cost_settings_org_settings_cost_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+Labour cost per rep and the commission model the cost reports use. Admin only.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getCostSettings();
+```
+
+---
+
+<a id="op-getdeliverabilityprotection"></a>
+
+### `g8.api.settings.getDeliverabilityProtection(input?)`
+
+**Get Deliverability Protection**
+
+- HTTP: `GET /api/v1/org/settings/deliverability-protection`
+- operationId: `get_deliverability_protection_org_settings_deliverability_protection_get` (also callable as `g8.api.call("get_deliverability_protection_org_settings_deliverability_protection_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+Which high-risk content categories are blocked, with a preview of each rule set.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getDeliverabilityProtection();
+```
+
+---
+
+<a id="op-getdepartments"></a>
+
+### `g8.api.settings.getDepartments(input?)`
+
+**Get Departments**
+
+- HTTP: `GET /api/v1/org/settings/departments`
+- operationId: `get_departments_org_settings_departments_get` (also callable as `g8.api.call("get_departments_org_settings_departments_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+The org's department taxonomy, in display order.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getDepartments();
+```
+
+---
+
+<a id="op-getoutboundtracking"></a>
+
+### `g8.api.settings.getOutboundTracking(input?)`
+
+**Get Outbound Tracking**
+
+- HTTP: `GET /api/v1/org/settings/outbound-tracking`
+- operationId: `get_outbound_tracking_org_settings_outbound_tracking_get` (also callable as `g8.api.call("get_outbound_tracking_org_settings_outbound_tracking_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+Whether outbound links are UTM-tagged, and on which channels.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getOutboundTracking();
+```
+
+---
+
+<a id="op-getssoconfig"></a>
+
+### `g8.api.settings.getSsoConfig(input?)`
+
+**Get Sso Config**
+
+- HTTP: `GET /api/v1/org/sso`
+- operationId: `get_sso_config_org_sso_get` (also callable as `g8.api.call("get_sso_config_org_sso_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+The org's SSO configuration, or empty if none is set up.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getSsoConfig();
+```
+
+---
+
+<a id="op-getssometadata"></a>
+
+### `g8.api.settings.getSsoMetadata(input?)`
+
+**Get Sso Metadata**
+
+- HTTP: `GET /api/v1/org/sso/metadata`
+- operationId: `get_sso_metadata_org_sso_metadata_get` (also callable as `g8.api.call("get_sso_metadata_org_sso_metadata_get", input)`)
+- Tier: `read`: reads data; safe to call and to retry
+- API-key scope: `account:read`
+
+Service-provider metadata to hand to the identity provider.
+
+This is what you paste into Okta, Entra or similar when configuring the
+other side of the trust. It describes graph8; it contains no secret.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.getSsoMetadata();
+```
+
+---
+
+<a id="op-seeddepartmentdefaults"></a>
+
+### `g8.api.settings.seedDepartmentDefaults(input?)`
+
+**Seed Department Defaults**
+
+- HTTP: `POST /api/v1/org/settings/departments/seed-defaults`
+- operationId: `seed_department_defaults_org_settings_departments_seed_defaults_post` (also callable as `g8.api.call("seed_department_defaults_org_settings_departments_seed_defaults_post", input)`)
+- Tier: `destructive`: deletes or archives data; confirm with a human before calling
+- API-key scope: `account:delete`
+
+FORCE-REPLACE the taxonomy with the five defaults. Custom departments are lost.
+
+Tiered `destructive` for exactly that reason: nothing in the path says so.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+// destructive: deletes or archives data; confirm with a human before calling.
+const result = await g8.api.settings.seedDepartmentDefaults();
+```
+
+---
+
+<a id="op-syncssoconfig"></a>
+
+### `g8.api.settings.syncSsoConfig(input?)`
+
+**Sync Sso Config**
+
+- HTTP: `POST /api/v1/org/sso/sync`
+- operationId: `sync_sso_config_org_sso_sync_post` (also callable as `g8.api.call("sync_sso_config_org_sso_sync_post", input)`)
+- Tier: `external`: reaches real people (sends email/SMS, places a call, launches a send); the SDK never blindly retries it; confirm with a human first
+- API-key scope: `integrations:run`
+
+Re-push the stored configuration to the identity provider.
+
+Use it when the two sides have drifted - it reconciles rather than changing
+what you configured.
+
+**Input**: none.
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+// external: reaches real people (sends email/SMS, places a call, launches a send); the SDK never blindly retries it; confirm with a human first.
+const result = await g8.api.settings.syncSsoConfig();
+```
+
+---
+
+<a id="op-updatecostsettings"></a>
+
+### `g8.api.settings.updateCostSettings(input)`
+
+**Update Cost Settings**
+
+- HTTP: `PUT /api/v1/org/settings/cost`
+- operationId: `update_cost_settings_org_settings_cost_put` (also callable as `g8.api.call("update_cost_settings_org_settings_cost_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Replace the cost configuration. Employee keys are email addresses, lowercased.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `OrgCostSettingsRequest` | yes | Request body; fields below. |
+
+Body fields (`OrgCostSettingsRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.commission` | `CommissionConfig` | no |  |
+| `body.employees` | `Record<string, EmployeeCost>` | no |  |
+| `body.enabled` | `boolean` | no | default `false` |
+| `body.version` | `integer` | no | default `1` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.updateCostSettings({ body: {} });
+```
+
+---
+
+<a id="op-updatedeliverabilityprotection"></a>
+
+### `g8.api.settings.updateDeliverabilityProtection(input)`
+
+**Update Deliverability Protection**
+
+- HTTP: `PUT /api/v1/org/settings/deliverability-protection`
+- operationId: `update_deliverability_protection_org_settings_deliverability_protection_put` (also callable as `g8.api.call("update_deliverability_protection_org_settings_deliverability_protection_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Switch the protection on or off, and choose the blocked categories.
+
+Org-wide: it changes what every sequence may send. Turning it off removes a
+guard, not a feature, so it is audited under the key-holder's identity.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `OrgDeliverabilityProtectionRequest` | yes | Request body; fields below. |
+
+Body fields (`OrgDeliverabilityProtectionRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.categories` | `Array<string>` | no |  |
+| `body.enabled` | `boolean` | no | default `true` |
+| `body.version` | `1` | no | default `1` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.updateDeliverabilityProtection({ body: {} });
+```
+
+---
+
+<a id="op-updatedepartments"></a>
+
+### `g8.api.settings.updateDepartments(input)`
+
+**Update Departments**
+
+- HTTP: `PUT /api/v1/org/settings/departments`
+- operationId: `update_departments_org_settings_departments_put` (also callable as `g8.api.call("update_departments_org_settings_departments_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Replace the department list. Slugs must be unique; an omitted entry is removed.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `OrgDepartmentsUpdateRequest` | yes | Request body; fields below. |
+
+Body fields (`OrgDepartmentsUpdateRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.entries` | `Array<DepartmentEntry>` | yes | max items 100 |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.updateDepartments({ body: { entries: [{ name: "Example", slug: "example" }] } });
+```
+
+---
+
+<a id="op-updateoutboundtracking"></a>
+
+### `g8.api.settings.updateOutboundTracking(input)`
+
+**Update Outbound Tracking**
+
+- HTTP: `PUT /api/v1/org/settings/outbound-tracking`
+- operationId: `update_outbound_tracking_org_settings_outbound_tracking_put` (also callable as `g8.api.call("update_outbound_tracking_org_settings_outbound_tracking_put", input)`)
+- Tier: `write`: creates or changes records; the SDK sends an Idempotency-Key and retries transient failures
+- API-key scope: `account:write`
+
+Replace the outbound tracking configuration.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `OrgOutboundTrackingRequest` | yes | Request body; fields below. |
+
+Body fields (`OrgOutboundTrackingRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.channels` | `OutboundTrackingChannels` | no |  |
+| `body.enabled` | `boolean` | no | default `false` |
+| `body.utm_source_prefix` | `string \| null` | no |  |
+| `body.version` | `integer` | no | default `1` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+const result = await g8.api.settings.updateOutboundTracking({ body: {} });
+```
+
+---
+
+<a id="op-updatessoenforcement"></a>
+
+### `g8.api.settings.updateSsoEnforcement(input)`
+
+**Update Sso Enforcement**
+
+- HTTP: `PUT /api/v1/org/sso/enforcement`
+- operationId: `update_sso_enforcement_org_sso_enforcement_put` (also callable as `g8.api.call("update_sso_enforcement_org_sso_enforcement_put", input)`)
+- Tier: `destructive`: deletes or archives data; confirm with a human before calling
+- API-key scope: `account:delete`
+
+Decide whether SSO is the ONLY way in.
+
+Enforcing it blocks every other sign-in method. That is the point of it,
+and it is also the single most effective way to lock an org out of its own
+account - enforce only once you have signed in through SSO yourself.
+
+**Input**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body` | `SsoEnforcementRequest` | yes | Request body; fields below. |
+
+Body fields (`SsoEnforcementRequest`):
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `body.allow_unverified_domain_members` | `boolean \| null` | no | Whether members on an unverified email domain may still sign in. |
+| `body.allowed_domains` | `Array<string> \| null` | no |  |
+| `body.grant_ttl_minutes` | `integer \| null` | no | How long an SSO grant stays valid. |
+| `body.require_sso` | `boolean` | no | True makes SSO the only way in. Defaults to false, as the app's does. default `false` |
+
+**Returns** `ApiResponse_SettingsPayload_`: the envelope `{ data: SettingsPayload, ... }`. `g8.api` returns the envelope as-is, so read `result.data`.
+
+Other envelope fields: `pagination` (PaginationMeta).
+
+**Example**
+
+```ts
+// destructive: deletes or archives data; confirm with a human before calling.
+const result = await g8.api.settings.updateSsoEnforcement({ body: {} });
+```
+
+---
+
+## Referenced types
+
+Named types that appear in the tables above. Full TypeScript definitions: `G8Contract.<Name>` (`import type { G8Contract } from "@graph8/sdk"`).
+
+<a id="type-commissionconfig"></a>
+
+### `CommissionConfig`
+
+Commission model. v1 supports ``none`` and ``per_meeting`` only — ``revenue_pct`` needs per-rep deal attribution we don't have cleanly yet (Phase 2), so it is rejected by the validator.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `mode` | `"none" \| "per_meeting"` | no | default `"none"` |
+| `per_employee_overrides` | `Record<string, EmployeeCommissionOverride>` | no |  |
+| `per_meeting_rate` | `number` | no | default `0`, min 0 |
+
+<a id="type-departmententry"></a>
+
+### `DepartmentEntry`
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `name` | `string` | yes | min length 1, max length 64 |
+| `slug` | `string` | yes | min length 1, max length 64 |
+| `color` | `string \| null` | no | max length 9 |
+| `description` | `string \| null` | no | max length 500 |
+| `hidden` | `boolean` | no | default `false` |
+| `id` | `string` | no | default `""` |
+| `is_system_seed` | `boolean` | no | default `false` |
+| `sort_order` | `integer` | no | default `0` |
+
+<a id="type-employeecost"></a>
+
+### `EmployeeCost`
+
+A single rep's labor cost. ``role`` is informational (sdr/ae/other). ``name`` is intentionally optional (default "") at the API layer — direct API callers may store cost keyed by email alone. The settings UI requires a name for usability; a27/a28 fall back to the email for display when blank.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `monthly_cost` | `number` | no | default `0`, min 0 |
+| `name` | `string` | no | default `""` |
+| `role` | `"sdr" \| "ae" \| "other"` | no | default `"other"` |
+
+<a id="type-outboundtrackingchannels"></a>
+
+### `OutboundTrackingChannels`
+
+Per-channel UTM injection toggles. email, linkedin, and whatsapp are wired into their send paths; sms/voice/dialer use booking-link tokens.
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `dialer` | `boolean` | no | default `false` |
+| `email` | `boolean` | no | default `false` |
+| `linkedin` | `boolean` | no | default `false` |
+| `sms` | `boolean` | no | default `false` |
+| `voice` | `boolean` | no | default `false` |
+| `whatsapp` | `boolean` | no | default `false` |