@greensecurity/javascript-sdk 0.45.0-beta.9 → 0.46.0-beta.1

package/dist/esm/sdk/users.d.ts

@@ -11,6 +11,8 @@ export declare class Users extends ClientSDK {
      * By default the response returns a compact profile (id, name, email,
      * phone, timezone, user type, and a handful of confirmation flags).
      *
+     * **Permissions.** Requires a valid token only - a caller may always read their own record.
+     *
      * Supported `expand` values:
      * - `user` — return the full user record, including all profile fields stored against the user (sensitive columns such as passwords, MFA codes, and payment-provider IDs are always omitted)
      * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -31,6 +33,8 @@ export declare class Users extends ClientSDK {
      * By default the response returns a compact profile (id, name, email,
      * phone, timezone, user type, and a handful of confirmation flags).
      *
+     * **Permissions.** Requires any of `users.view`, `vendors.view`, `contacts.view`, `inventory_managers.view` or `company_managers.view`. Which one applies depends on the target user's type; callers may always read their own record.
+     *
      * Supported `expand` values:
      * - `user` — return the full user record (sensitive columns such as passwords and payment-provider IDs are always omitted)
      * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -47,6 +51,12 @@ export declare class Users extends ClientSDK {
      * Only submitted fields are applied — unrecognised fields are silently ignored.
      * Changing `email` automatically resets `bounced_email` to `false`.
      *
+     * Submitting `zip`, `state`, or `country` cross-checks the postal code against the
+     * resulting state/country (using the existing value for any of the three left out
+     * of the request). A code that is not shaped like a real postal code, or that
+     * provably belongs to a different state, is rejected with `422` naming the correct
+     * state.
+     *
      * Each subkey of `email_preferences` is independently optional; sending
      * `{ "email_preferences": { "send_weekly_summary_email": true } }` flips
      * only that flag and leaves the others unchanged.
@@ -57,6 +67,8 @@ export declare class Users extends ClientSDK {
      * `GET ?expand=user.email_preferences` call.
      *
      * To rotate an API token use `POST /users/api_key_rotator` instead.
+     *
+     * **Permissions.** Requires the `users.edit` permission.
      */
     updateUser(request: operations.UpdateUserRequest, options?: RequestOptions): Promise<operations.UpdateUserUpdateUserOk>;
     /**
@@ -94,6 +106,45 @@ export declare class Users extends ClientSDK {
      * 3. Site redirects to your selected `return_url`
      * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
      * 5. Fetch the user object from `/users/me` using the token
+     *
+     * ## Finishing a "Login with Green Security" flow
+     *
+     * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+     * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+     * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+     * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+     *
+     * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+     * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+     * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+     * `mfa_code`.
+     *
+     * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+     * value from the response you just received rather than the one you started with. The two are normally the same
+     * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+     * you to hold login state you would otherwise not need.
+     *
+     * 1. Read `sso_state` from the query string of the login screen you were sent to
+     * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+     *    the next request from the previous `202` response
+     * 3. On the `200` response, read `sso.continue_url`
+     * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+     *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+     *    provider
+     * 5. The service provider validates the assertion and the user is signed in on their side
+     *
+     * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+     * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+     * the login still need has to ride the URL. Preserve the query string exactly as given.
+     *
+     * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+     * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+     * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+     * same blob; the user has to start again from the service provider. See the
+     * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+     * guide for the service provider half of this flow.
+     *
+     * **Permissions.** No authentication required.
      */
     postAuthenticate(request: operations.PostAuthenticateRequestBody, options?: RequestOptions): Promise<operations.PostAuthenticateResponse>;
     /**
@@ -101,6 +152,8 @@ export declare class Users extends ClientSDK {
      *
      * @remarks
      * Allows an API user to rotate their own API key. Note, the key rotation happens immediately so the user should be prepared to update their API key in their application for all subsequent requests.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     rotateApiKey(options?: RequestOptions): Promise<operations.RotateApiKeyRotateApiKeyOk>;
     /**
@@ -115,6 +168,8 @@ export declare class Users extends ClientSDK {
      * API users may additionally pass a numeric `user_id` to fetch another user's
      * linked users, provided they have an active app activation for that user.
      * Non-API users may only pass `me`.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     getLinkedUsers(request: operations.GetLinkedUsersRequest, options?: RequestOptions): Promise<operations.GetLinkedUsersGetLinkedUsersOk>;
     /**
@@ -122,6 +177,8 @@ export declare class Users extends ClientSDK {
      *
      * @remarks
      * If a user has two different types of accounts (i.e. Company Manager and Vendor) this endpoint allows the integration to swap the token from the existing user to the linked account user. For API integrations, the `source_user_id` field is required and must be the ID of the user whose session will be switched into the target user's token.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     switchAccount(request: operations.SwitchAccountRequestBody, options?: RequestOptions): Promise<operations.SwitchAccountResponseBody>;
     /**
@@ -129,6 +186,8 @@ export declare class Users extends ClientSDK {
      *
      * @remarks
      * It sends an email with a magic link to allow the user to log in.
+     *
+     * **Permissions.** No authentication required.
      */
     magiclink(request: operations.MagiclinkRequestBody, options?: RequestOptions): Promise<operations.MagiclinkMagiclinkOk>;
     /**
@@ -136,6 +195,8 @@ export declare class Users extends ClientSDK {
      *
      * @remarks
      * It sends an email with a link for resetting a user's password.
+     *
+     * **Permissions.** No authentication required.
      */
     passwordResetRequest(request: operations.PasswordResetRequestRequestBody, options?: RequestOptions): Promise<operations.PasswordResetRequestPasswordResetRequestOk>;
     /**
@@ -144,6 +205,8 @@ export declare class Users extends ClientSDK {
      * @remarks
      * Resets the a user's password using a password_reset_id that was sent to them via email.
      * See /users/passwordresetrequest to initiate a password reset flow.
+     *
+     * **Permissions.** No authentication required.
      */
     password(request: operations.PasswordRequestBody, options?: RequestOptions): Promise<operations.PasswordPasswordOk>;
     /**
@@ -151,13 +214,17 @@ export declare class Users extends ClientSDK {
      *
      * @remarks
      * Change the user's password to the new passed as parameter
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     changePassword(request: operations.ChangePasswordRequest, options?: RequestOptions): Promise<operations.ChangePasswordChangePasswordOk>;
     /**
      * Register profile picture metadata for S3 direct upload
      *
      * @remarks
-     * Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image's file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use 'me' as the id for the authenticated user. Requires authentication and either self-ownership or 'users:edit' permission. API users must be authorized via MarketplaceAppActivation for the target user.
+     * 'Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image''s file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use ''me'' as the id for the authenticated user. Requires authentication and either self-ownership or ''users:edit'' permission. API users must be authorized via MarketplaceAppActivation for the target user.'
+     *
+     * **Permissions.** For a regular user, requires self-ownership or the `users.edit` permission. For an API user, `users.edit` is not checked at all — authorization instead runs through the caller's update access scope on the target user, which a `MarketplaceAppActivation` grants at the user or site level.
      */
     updateUserProfilePicture(request: operations.UpdateUserProfilePictureRequest, options?: RequestOptions): Promise<operations.UpdateUserProfilePictureUpdateUserProfilePictureOk>;
 }

package/dist/esm/sdk/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;OAaG;IACG,WAAW,CACf,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,CAAC,iBAAiB,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;IAQ/C;;;;;OAKG;IACG,YAAY,CAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC;IAOjD;;;;;;;;;;;;OAYG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,aAAa,CACjB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,UAAU,CAAC,oBAAoB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IAQ3C;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0CAA0C,CAAC;IAQjE;;;;;;OAMG;IACG,QAAQ,CACZ,OAAO,EAAE,UAAU,CAAC,mBAAmB,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAQzC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kDAAkD,CAAC;CAO1E"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;;;OAeG;IACG,WAAW,CACf,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,CAAC,iBAAiB,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;IAQ/C;;;;;;;OAOG;IACG,YAAY,CAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC;IAOjD;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;;;OAOG;IACG,aAAa,CACjB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;;;OAOG;IACG,SAAS,CACb,OAAO,EAAE,UAAU,CAAC,oBAAoB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IAQ3C;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0CAA0C,CAAC;IAQjE;;;;;;;;OAQG;IACG,QAAQ,CACZ,OAAO,EAAE,UAAU,CAAC,mBAAmB,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAQzC;;;;;;;OAOG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;;;OAOG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kDAAkD,CAAC;CAO1E"}

package/dist/esm/sdk/users.js

@@ -25,6 +25,8 @@ export class Users extends ClientSDK {
      * By default the response returns a compact profile (id, name, email,
      * phone, timezone, user type, and a handful of confirmation flags).
      *
+     * **Permissions.** Requires a valid token only - a caller may always read their own record.
+     *
      * Supported `expand` values:
      * - `user` — return the full user record, including all profile fields stored against the user (sensitive columns such as passwords, MFA codes, and payment-provider IDs are always omitted)
      * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -47,6 +49,8 @@ export class Users extends ClientSDK {
      * By default the response returns a compact profile (id, name, email,
      * phone, timezone, user type, and a handful of confirmation flags).
      *
+     * **Permissions.** Requires any of `users.view`, `vendors.view`, `contacts.view`, `inventory_managers.view` or `company_managers.view`. Which one applies depends on the target user's type; callers may always read their own record.
+     *
      * Supported `expand` values:
      * - `user` — return the full user record (sensitive columns such as passwords and payment-provider IDs are always omitted)
      * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -65,6 +69,12 @@ export class Users extends ClientSDK {
      * Only submitted fields are applied — unrecognised fields are silently ignored.
      * Changing `email` automatically resets `bounced_email` to `false`.
      *
+     * Submitting `zip`, `state`, or `country` cross-checks the postal code against the
+     * resulting state/country (using the existing value for any of the three left out
+     * of the request). A code that is not shaped like a real postal code, or that
+     * provably belongs to a different state, is rejected with `422` naming the correct
+     * state.
+     *
      * Each subkey of `email_preferences` is independently optional; sending
      * `{ "email_preferences": { "send_weekly_summary_email": true } }` flips
      * only that flag and leaves the others unchanged.
@@ -75,6 +85,8 @@ export class Users extends ClientSDK {
      * `GET ?expand=user.email_preferences` call.
      *
      * To rotate an API token use `POST /users/api_key_rotator` instead.
+     *
+     * **Permissions.** Requires the `users.edit` permission.
      */
     async updateUser(request, options) {
         return unwrapAsync(usersUpdateUser(this, request, options));
@@ -114,6 +126,45 @@ export class Users extends ClientSDK {
      * 3. Site redirects to your selected `return_url`
      * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
      * 5. Fetch the user object from `/users/me` using the token
+     *
+     * ## Finishing a "Login with Green Security" flow
+     *
+     * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+     * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+     * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+     * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+     *
+     * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+     * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+     * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+     * `mfa_code`.
+     *
+     * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+     * value from the response you just received rather than the one you started with. The two are normally the same
+     * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+     * you to hold login state you would otherwise not need.
+     *
+     * 1. Read `sso_state` from the query string of the login screen you were sent to
+     * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+     *    the next request from the previous `202` response
+     * 3. On the `200` response, read `sso.continue_url`
+     * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+     *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+     *    provider
+     * 5. The service provider validates the assertion and the user is signed in on their side
+     *
+     * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+     * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+     * the login still need has to ride the URL. Preserve the query string exactly as given.
+     *
+     * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+     * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+     * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+     * same blob; the user has to start again from the service provider. See the
+     * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+     * guide for the service provider half of this flow.
+     *
+     * **Permissions.** No authentication required.
      */
     async postAuthenticate(request, options) {
         return unwrapAsync(usersPostAuthenticate(this, request, options));
@@ -123,6 +174,8 @@ export class Users extends ClientSDK {
      *
      * @remarks
      * Allows an API user to rotate their own API key. Note, the key rotation happens immediately so the user should be prepared to update their API key in their application for all subsequent requests.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async rotateApiKey(options) {
         return unwrapAsync(usersRotateApiKey(this, options));
@@ -139,6 +192,8 @@ export class Users extends ClientSDK {
      * API users may additionally pass a numeric `user_id` to fetch another user's
      * linked users, provided they have an active app activation for that user.
      * Non-API users may only pass `me`.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async getLinkedUsers(request, options) {
         return unwrapAsync(usersGetLinkedUsers(this, request, options));
@@ -148,6 +203,8 @@ export class Users extends ClientSDK {
      *
      * @remarks
      * If a user has two different types of accounts (i.e. Company Manager and Vendor) this endpoint allows the integration to swap the token from the existing user to the linked account user. For API integrations, the `source_user_id` field is required and must be the ID of the user whose session will be switched into the target user's token.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async switchAccount(request, options) {
         return unwrapAsync(usersSwitchAccount(this, request, options));
@@ -157,6 +214,8 @@ export class Users extends ClientSDK {
      *
      * @remarks
      * It sends an email with a magic link to allow the user to log in.
+     *
+     * **Permissions.** No authentication required.
      */
     async magiclink(request, options) {
         return unwrapAsync(usersMagiclink(this, request, options));
@@ -166,6 +225,8 @@ export class Users extends ClientSDK {
      *
      * @remarks
      * It sends an email with a link for resetting a user's password.
+     *
+     * **Permissions.** No authentication required.
      */
     async passwordResetRequest(request, options) {
         return unwrapAsync(usersPasswordResetRequest(this, request, options));
@@ -176,6 +237,8 @@ export class Users extends ClientSDK {
      * @remarks
      * Resets the a user's password using a password_reset_id that was sent to them via email.
      * See /users/passwordresetrequest to initiate a password reset flow.
+     *
+     * **Permissions.** No authentication required.
      */
     async password(request, options) {
         return unwrapAsync(usersPassword(this, request, options));
@@ -185,6 +248,8 @@ export class Users extends ClientSDK {
      *
      * @remarks
      * Change the user's password to the new passed as parameter
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async changePassword(request, options) {
         return unwrapAsync(usersChangePassword(this, request, options));
@@ -193,7 +258,9 @@ export class Users extends ClientSDK {
      * Register profile picture metadata for S3 direct upload
      *
      * @remarks
-     * Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image's file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use 'me' as the id for the authenticated user. Requires authentication and either self-ownership or 'users:edit' permission. API users must be authorized via MarketplaceAppActivation for the target user.
+     * 'Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image''s file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use ''me'' as the id for the authenticated user. Requires authentication and either self-ownership or ''users:edit'' permission. API users must be authorized via MarketplaceAppActivation for the target user.'
+     *
+     * **Permissions.** For a regular user, requires self-ownership or the `users.edit` permission. For an API user, `users.edit` is not checked at all — authorization instead runs through the caller's update access scope on the target user, which a `MarketplaceAppActivation` grants at the user or site level.
      */
     async updateUserProfilePicture(request, options) {
         return unwrapAsync(usersUpdateUserProfilePicture(this, request, options));

package/dist/esm/sdk/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,WAAW,CACf,OAAsC,EACtC,OAAwB;QAExB,OAAO,WAAW,CAAC,gBAAgB,CACjC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,UAAU,CACd,OAAqC,EACrC,OAAwB;QAExB,OAAO,WAAW,CAAC,eAAe,CAChC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAA+C,EAC/C,OAAwB;QAExB,OAAO,WAAW,CAAC,qBAAqB,CACtC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAwB;QAExB,OAAO,WAAW,CAAC,iBAAiB,CAClC,IAAI,EACJ,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,kBAAkB,CACnC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,OAAwC,EACxC,OAAwB;QAExB,OAAO,WAAW,CAAC,cAAc,CAC/B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,yBAAyB,CAC1C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAuC,EACvC,OAAwB;QAExB,OAAO,WAAW,CAAC,aAAa,CAC9B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,WAAW,CACf,OAAsC,EACtC,OAAwB;QAExB,OAAO,WAAW,CAAC,gBAAgB,CACjC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,UAAU,CACd,OAAqC,EACrC,OAAwB;QAExB,OAAO,WAAW,CAAC,eAAe,CAChC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAA+C,EAC/C,OAAwB;QAExB,OAAO,WAAW,CAAC,qBAAqB,CACtC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,OAAwB;QAExB,OAAO,WAAW,CAAC,iBAAiB,CAClC,IAAI,EACJ,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,kBAAkB,CACnC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,OAAwC,EACxC,OAAwB;QAExB,OAAO,WAAW,CAAC,cAAc,CAC/B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,yBAAyB,CAC1C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAuC,EACvC,OAAwB;QAExB,OAAO,WAAW,CAAC,aAAa,CAC9B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/sdk/vendorfields.d.ts

@@ -12,6 +12,8 @@ export declare class VendorFields extends ClientSDK {
      *
      * For API users: source_user_id is required. The API user acts on behalf of that user
      * (e.g. a company manager). The app must be activated for that user via MarketplaceAppActivation.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     createVendorField(request: operations.CreateVendorFieldRequestBody, options?: RequestOptions): Promise<operations.CreateVendorFieldResponseBody>;
     /**
@@ -22,6 +24,8 @@ export declare class VendorFields extends ClientSDK {
      * the name cannot be modified after creation.
      *
      * For API users: source_user_id is required. The API user acts on behalf of that user.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     updateVendorField(request: operations.UpdateVendorFieldRequest, options?: RequestOptions): Promise<operations.UpdateVendorFieldResponseBody>;
 }

package/dist/esm/sdk/vendorfields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendorfields.d.ts","sourceRoot":"","sources":["../../../src/sdk/vendorfields.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,YAAa,SAAQ,SAAS;IACzC;;;;;;;;;;;OAWG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,4BAA4B,EAChD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;IAQpD;;;;;;;;OAQG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;CAOrD"}
+{"version":3,"file":"vendorfields.d.ts","sourceRoot":"","sources":["../../../src/sdk/vendorfields.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,YAAa,SAAQ,SAAS;IACzC;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,4BAA4B,EAChD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;IAQpD;;;;;;;;;;OAUG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;CAOrD"}

package/dist/esm/sdk/vendorfields.js

@@ -17,6 +17,8 @@ export class VendorFields extends ClientSDK {
      *
      * For API users: source_user_id is required. The API user acts on behalf of that user
      * (e.g. a company manager). The app must be activated for that user via MarketplaceAppActivation.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async createVendorField(request, options) {
         return unwrapAsync(vendorFieldsCreateVendorField(this, request, options));
@@ -29,6 +31,8 @@ export class VendorFields extends ClientSDK {
      * the name cannot be modified after creation.
      *
      * For API users: source_user_id is required. The API user acts on behalf of that user.
+     *
+     * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
      */
     async updateVendorField(request, options) {
         return unwrapAsync(vendorFieldsUpdateVendorField(this, request, options));

package/dist/esm/sdk/vendorfields.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendorfields.js","sourceRoot":"","sources":["../../../src/sdk/vendorfields.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAgD,EAChD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"vendorfields.js","sourceRoot":"","sources":["../../../src/sdk/vendorfields.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAgD,EAChD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}