@hearth-auth/sdk 2.0.3 → 3.0.0

package/dist/generated/admin/schema.d.ts

@@ -0,0 +1,3648 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export interface paths {
+    "/admin/applications": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["ApplicationAdminService_ListApplications"];
+        put?: never;
+        post: operations["ApplicationAdminService_CreateApplication"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/applications/{client_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["ApplicationAdminService_GetApplication"];
+        put?: never;
+        post?: never;
+        delete: operations["ApplicationAdminService_DeleteApplication"];
+        options?: never;
+        head?: never;
+        patch: operations["ApplicationAdminService_UpdateApplication"];
+        trace?: never;
+    };
+    "/admin/applications/{client_id}/regenerate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Replaces a confidential client's secret with a new Hearth-generated one
+         *     (256 bits from the OS CSPRNG, stored only as a hash). The new secret is
+         *     returned once, in the response's client_secret; the old one stops
+         *     authenticating at once. Refused for a public client. Audited.
+         */
+        post: operations["ApplicationAdminService_RegenerateApplicationSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/assignments/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Delete a role assignment */
+        delete: operations["adminUnassignRole"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/audit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List audit events
+         * @description Requires `hearth.realm.admin`. Newest first.
+         */
+        get: operations["adminListAuditEvents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/audit/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Verify the realm's audit hash chain */
+        post: operations["adminVerifyAudit"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/backup": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Create a backup */
+        post: operations["adminBackupCreate"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/backup/restore": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Restore from a backup */
+        post: operations["adminBackupRestore"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/bootstrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dev bootstrap (--dev mode only)
+         * @description Seeds a realm and admin user on first call. Returns tokens on every call.
+         *     Available **only** in `--dev` mode; returns `404` in production.
+         *     Re-bootstrap (realm already exists) refreshes tokens but does **not** reset
+         *     the admin password — include the `Authorization: Bearer <access_token>` header
+         *     from the first bootstrap call.
+         */
+        post: operations["adminBootstrap"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/cluster/bootstrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Bootstrap the Raft cluster */
+        post: operations["adminClusterBootstrap"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/cluster/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Raft cluster status */
+        get: operations["adminClusterStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/cluster/transfer-leadership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Step the Raft leader down
+         * @description Steps this node down so another voter wins the next election. This is not a targeted transfer: the pinned Raft library cannot choose the winner, so a body naming target_node_id is refused with 422, and a body with any other field is refused with 400.
+         */
+        post: operations["adminClusterTransferLeadership"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/groups": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List groups
+         * @description `cursor` is a decimal offset; follow `next_cursor` until it is null.
+         */
+        get: operations["adminListGroups"];
+        put?: never;
+        /** Create a group */
+        post: operations["adminCreateGroup"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/groups/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** Get a group */
+        get: operations["adminGetGroup"];
+        put?: never;
+        post?: never;
+        /** Delete a group */
+        delete: operations["adminDeleteGroup"];
+        options?: never;
+        head?: never;
+        /**
+         * Update a group
+         * @description Absent fields are unchanged; `description` null clears it.
+         */
+        patch: operations["adminUpdateGroup"];
+        trace?: never;
+    };
+    "/admin/groups/{id}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** List a group's members */
+        get: operations["adminListGroupMembers"];
+        put?: never;
+        /** Add a member to a group */
+        post: operations["adminAddGroupMember"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/groups/{id}/members/{member_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Remove a member from a group */
+        delete: operations["adminRemoveGroupMember"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/groups/{id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Assign a role to a group
+         * @description Body: `{role_id, org_id?}`. Same ceiling and org-existence rules as `POST /admin/users/{id}/roles`. Unassign with `DELETE /admin/assignments/{id}`.
+         */
+        post: operations["adminAssignGroupRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/organizations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List organizations
+         * @description Requires `hearth.realm.admin`. `cursor` is a decimal offset; follow `next_cursor` until it is null.
+         */
+        get: operations["adminListOrganizations"];
+        put?: never;
+        /**
+         * Create an organization
+         * @description Requires `hearth.realm.admin`. Body: `{slug, display_name, member_limit?, mfa_required?, attributes?}`. `mfa_required` (default `false`) makes members need MFA even where the realm does not; it can only tighten. Refused in the system realm.
+         */
+        post: operations["adminCreateOrganization"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/organizations/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** Get an organization */
+        get: operations["adminGetOrganization"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete an organization
+         * @description Refused when a member holds admin authority in the organization that the caller lacks.
+         */
+        delete: operations["adminDeleteOrganization"];
+        options?: never;
+        head?: never;
+        /**
+         * Update an organization
+         * @description Body: `{display_name?, status? (active|suspended), member_limit?, mfa_required?, attributes?}`. A field left out keeps its value. A `slug` is refused with 400 (it is immutable). Suspending is checked against the admin privilege ceiling, like a delete.
+         */
+        patch: operations["adminUpdateOrganization"];
+        trace?: never;
+    };
+    "/admin/organizations/{id}/members/{user_id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** List a member's extra org roles */
+        get: operations["adminListAdditionalRoles"];
+        put?: never;
+        /**
+         * Give a member an extra org role
+         * @description Body: `{role_name}`. The user must be a member (409 otherwise); a sub-admin may only give roles within its own permissions.
+         */
+        post: operations["adminAddAdditionalRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/organizations/{id}/members/{user_id}/roles/{role_name}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a member's extra org role
+         * @description Checked against the admin privilege ceiling.
+         */
+        delete: operations["adminRemoveAdditionalRole"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List the realm's permission registry */
+        get: operations["adminListPermissions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Realms — operate against the system realm (mutations require admin in
+         *     the system realm). `x-realm-id` metadata is ignored for these RPCs.
+         */
+        get: operations["IdentityAdminService_ListRealms"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["IdentityAdminService_GetRealm"];
+        put?: never;
+        post?: never;
+        delete: operations["IdentityAdminService_DeleteRealm"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}/branding": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get realm branding config */
+        get: operations["adminGetRealmBranding"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Patch realm branding config */
+        patch: operations["adminPatchRealmBranding"];
+        trace?: never;
+    };
+    "/admin/realms/{id}/email-templates": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List email templates for a realm */
+        get: operations["adminListRealmEmailTemplates"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}/email-templates/{kind}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get an email template */
+        get: operations["adminGetRealmEmailTemplate"];
+        /** Replace an email template */
+        put: operations["adminPutRealmEmailTemplate"];
+        post?: never;
+        /** Delete an email template (revert to default) */
+        delete: operations["adminDeleteRealmEmailTemplate"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}/rotate-signing-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate the realm's Ed25519 signing key
+         * @description Publishes a new signing key and revokes every retired key for the realm. Tokens signed with the old key stop validating immediately, which is what makes this a usable remedy for a leaked key. A planned rotation may opt into a grace window with `grace_period_secs`; do not use it after a compromise, because the window protects whoever holds the leaked key too.
+         */
+        post: operations["adminRotateRealmSigningKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}/suspend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Suspend a realm (incident-response freeze)
+         * @description Every token of the realm stops validating, its sessions are revoked and no new session starts until the realm is reinstated. Caller must be a system-realm admin (`hearth.realm.admin` or `hearth.admin`, with `X-Realm-ID` set to the system realm); the target realm's cross-realm trust policy applies. The system realm cannot be suspended. Audited in the target realm with the actor and old/new status. YAML reconciliation never clears a suspension.
+         */
+        post: operations["IdentityAdminService_SuspendRealm"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{id}/unsuspend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reinstate a suspended realm
+         * @description Restores a suspended realm to active. Same gate as suspend. An archived realm is not revived (409): only reappearing in hearth.yaml does that.
+         */
+        post: operations["IdentityAdminService_UnsuspendRealm"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{realm_id}/config": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Patch realm config */
+        patch: operations["adminPatchRealmConfig"];
+        trace?: never;
+    };
+    "/admin/realms/{realm_id}/sv-bump-all": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Bump all session versions in a realm */
+        post: operations["adminSvBumpAll"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/realms/{realm_id}/users/{user_id}/required-actions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Patch required actions for a user */
+        patch: operations["adminPatchUserRequiredActions"];
+        trace?: never;
+    };
+    "/admin/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List roles
+         * @description Requires `hearth.realm.admin`. Follow `next_cursor` until it is null.
+         */
+        get: operations["adminListRoles"];
+        put?: never;
+        /** Create a role */
+        post: operations["adminCreateRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/roles/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** Get a role */
+        get: operations["adminGetRole"];
+        put?: never;
+        post?: never;
+        /** Delete a role */
+        delete: operations["adminDeleteRole"];
+        options?: never;
+        head?: never;
+        /**
+         * Update a role
+         * @description Absent fields are unchanged; `description` null clears it.
+         */
+        patch: operations["adminUpdateRole"];
+        trace?: never;
+    };
+    "/admin/roles/{id}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List the users and groups holding a role */
+        get: operations["adminListRoleMembers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/sessions/{session_id}/sv-bump": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Bump session version (invalidates existing tokens) */
+        post: operations["adminSvBumpSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Users */
+        get: operations["IdentityAdminService_ListUsers"];
+        put?: never;
+        post: operations["IdentityAdminService_CreateUser"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/bulk": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Bulk create or disable users */
+        post: operations["adminBulkUsers"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/export": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Export users */
+        get: operations["adminExportUsers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/import": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Import users (migration) */
+        post: operations["adminImportUsers"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["IdentityAdminService_GetUser"];
+        put?: never;
+        post?: never;
+        delete: operations["IdentityAdminService_DeleteUser"];
+        options?: never;
+        head?: never;
+        patch: operations["IdentityAdminService_UpdateUser"];
+        trace?: never;
+    };
+    "/admin/users/{id}/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** List a user's direct permission grants */
+        get: operations["adminListUserPermissions"];
+        put?: never;
+        /**
+         * Grant a permission directly to a user
+         * @description Body: `{permission, org_id?}`. A sub-admin may grant only a permission it holds; `granted_by` is the caller.
+         */
+        post: operations["adminGrantUserPermission"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{id}/permissions/{permission}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a direct permission grant
+         * @description Add `?org_id=` for an org-scoped grant. Checked against the admin privilege ceiling.
+         */
+        delete: operations["adminRevokeUserPermission"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        /** List a user's role assignments */
+        get: operations["adminListUserAssignments"];
+        put?: never;
+        /**
+         * Assign a role to a user
+         * @description Realm-wide, or inside one organization when `org_id` is set.
+         */
+        post: operations["adminAssignUserRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{user_id}/consents": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List all active consents for a user. */
+        get: operations["RbacAdminService_ListUserConsents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{user_id}/consents/{client_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Revoke OAuth consent for a specific (user, client) pair. */
+        delete: operations["RbacAdminService_RevokeConsent"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users/{user_id}/effective-permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["RbacAdminService_ResolveEffectivePermissions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/webhooks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List webhooks */
+        get: operations["adminListWebhooks"];
+        put?: never;
+        /** Create a webhook */
+        post: operations["adminCreateWebhook"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/webhooks/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a webhook */
+        get: operations["adminGetWebhook"];
+        /** Replace a webhook */
+        put: operations["adminUpdateWebhook"];
+        post?: never;
+        /** Delete a webhook */
+        delete: operations["adminDeleteWebhook"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/webhooks/{id}/deliveries": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List webhook deliveries */
+        get: operations["adminListWebhookDeliveries"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        AdminAddAdditionalRoleRequest: {
+            role_name: string;
+        };
+        AdminAddGroupMemberRequest: {
+            /** @enum {string} */
+            type: "user" | "group";
+            /** Format: uuid */
+            id: string;
+        };
+        AdminAssignRoleRequest: {
+            /** Format: uuid */
+            role_id: string;
+            /**
+             * Format: uuid
+             * @description Assign inside this organization only; absent or null assigns realm-wide.
+             */
+            org_id?: string | null;
+        };
+        AdminAssignmentScope: {
+            /** @enum {string} */
+            type: "realm" | "org";
+            /**
+             * Format: uuid
+             * @description Present when `type` is `org`.
+             */
+            org_id?: string;
+        };
+        AdminAuditEvent: {
+            id: string;
+            /** Format: uuid */
+            realm_id: string;
+            actor: string;
+            /** @description The audit action name, e.g. `UserCreated`. */
+            action: string;
+            resource_type: string;
+            resource_id: string;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            timestamp: number;
+            /** @description Present only when the event carries metadata. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+            integrity_hash: string;
+        };
+        AdminAuditEventList: {
+            events: components["schemas"]["AdminAuditEvent"][];
+        };
+        AdminCreateGroupRequest: {
+            name: string;
+            slug: string;
+            description?: string | null;
+        };
+        AdminCreateOrganizationRequest: {
+            slug: string;
+            display_name: string;
+            /** Format: int32 */
+            member_limit?: number | null;
+            /** @default false */
+            mfa_required: boolean;
+            attributes?: {
+                [key: string]: string;
+            };
+        };
+        AdminCreateRoleRequest: {
+            name: string;
+            description?: string | null;
+            permissions?: string[];
+            parent_roles?: string[];
+        };
+        AdminGroup: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            realm_id: string;
+            name: string;
+            slug: string;
+            description: string | null;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            created_at: number;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            updated_at: number;
+        };
+        AdminGroupMemberPage: {
+            items: components["schemas"]["AdminSubject"][];
+            next_cursor: string | null;
+        };
+        AdminGroupMembership: {
+            /** Format: uuid */
+            group_id: string;
+            member: components["schemas"]["AdminSubject"];
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            added_at: number;
+            /** Format: uuid */
+            added_by: string | null;
+        };
+        AdminGroupPage: {
+            items: components["schemas"]["AdminGroup"][];
+            next_cursor: string | null;
+            /** Format: int64 */
+            total: number;
+        };
+        AdminOrganization: {
+            /** Format: uuid */
+            id: string;
+            slug: string;
+            display_name: string;
+            /** @enum {string} */
+            status: "active" | "suspended" | "archived";
+            /** Format: int32 */
+            member_limit?: number | null;
+            /** @description Members need MFA even where the realm does not require it. */
+            mfa_required: boolean;
+            attributes: {
+                [key: string]: string;
+            };
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            created_at: number;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            updated_at: number;
+        };
+        AdminOrganizationPage: {
+            items: components["schemas"]["AdminOrganization"][];
+            next_cursor?: string | null;
+        };
+        AdminRole: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            realm_id: string;
+            name: string;
+            description: string | null;
+            permissions: string[];
+            parent_roles: string[];
+            /** @enum {string} */
+            scope_kind: "realm" | "organization" | "any";
+            /** @enum {string} */
+            status: "active" | "archived";
+            /** @description Declared in hearth.yaml; the admin API cannot change it. */
+            yaml_managed: boolean;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            created_at: number;
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            updated_at: number;
+        };
+        AdminRoleAssignment: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            realm_id: string;
+            subject: components["schemas"]["AdminSubject"];
+            /** Format: uuid */
+            role_id: string;
+            scope: components["schemas"]["AdminAssignmentScope"];
+            /**
+             * Format: int64
+             * @description Microseconds since the Unix epoch.
+             */
+            assigned_at: number;
+            /** Format: uuid */
+            assigned_by: string | null;
+        };
+        AdminRoleAssignmentList: {
+            items: components["schemas"]["AdminRoleAssignment"][];
+        };
+        AdminRoleNameList: {
+            items: string[];
+        };
+        AdminRolePage: {
+            items: components["schemas"]["AdminRole"][];
+            next_cursor: string | null;
+        };
+        /** @description A user or a group, as a group member or a role-assignment subject. */
+        AdminSubject: {
+            /** @enum {string} */
+            type: "user" | "group";
+            /** Format: uuid */
+            id: string;
+        };
+        /** @description Absent fields are unchanged. */
+        AdminUpdateGroupRequest: {
+            name?: string;
+            slug?: string;
+            /** @description null clears the description. */
+            description?: string | null;
+        };
+        /** @description Absent fields are unchanged. `slug` is immutable and is refused with 400. */
+        AdminUpdateOrganizationRequest: {
+            display_name?: string;
+            /** @enum {string} */
+            status?: "active" | "suspended";
+            /** Format: int32 */
+            member_limit?: number | null;
+            mfa_required?: boolean;
+            /** @description Replaces the whole attribute map. */
+            attributes?: {
+                [key: string]: string;
+            };
+        };
+        /** @description Absent fields are unchanged. */
+        AdminUpdateRoleRequest: {
+            name?: string;
+            /** @description null clears the description. */
+            description?: string | null;
+            permissions?: string[];
+            parent_roles?: string[];
+        };
+        protobufAny: {
+            "@type"?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        rpcStatus: {
+            /** Format: int32 */
+            code?: number;
+            message?: string;
+            details?: components["schemas"]["protobufAny"][];
+        };
+        /**
+         * @description Controls how access-token authorization data is exposed to resource servers.
+         *
+         *      - EMBEDDED: Permissions, roles, and groups are embedded in the JWT at issuance (default).
+         *      - INTROSPECTION: JWT carries only identity claims; resource servers call /introspect.
+         *      - DECISION: JWT carries only identity claims; resource servers call POST /oauth/authorize.
+         * @default EMBEDDED
+         * @enum {string}
+         */
+        v1AccessTokenAuthorization: "EMBEDDED" | "INTROSPECTION" | "DECISION";
+        /**
+         * @description Controls whether a client is trusted as a first-party application.
+         *
+         *     FirstParty clients skip the consent screen and receive the full
+         *     `permissions`, `roles`, and `groups` claims in issued JWTs.  ThirdParty
+         *     clients are shown the consent screen and do not receive those claims.
+         *     Unspecified defaults to ThirdParty on the DCR path; on the authenticated
+         *     admin path the caller must pass FIRST_PARTY explicitly to grant first-party
+         *     trust.
+         * @default CLIENT_TRUST_LEVEL_UNSPECIFIED
+         * @enum {string}
+         */
+        v1ClientTrustLevel: "CLIENT_TRUST_LEVEL_UNSPECIFIED" | "CLIENT_TRUST_LEVEL_THIRD_PARTY" | "CLIENT_TRUST_LEVEL_FIRST_PARTY";
+        v1ConsentEntry: {
+            client_id?: string;
+            client_name?: string;
+            granted_scopes?: string[];
+            /** Format: int64 */
+            granted_at?: number;
+            /** Format: int64 */
+            updated_at?: number;
+        };
+        /** @description Request to create a new user. */
+        v1CreateUserRequest: {
+            email?: string;
+            display_name?: string;
+            first_name?: string;
+            last_name?: string;
+            attributes?: {
+                [key: string]: string;
+            };
+        };
+        /** @description Empty response type for delete RPCs. */
+        v1Empty: Record<string, never>;
+        v1ListUserConsentsResponse: {
+            consents?: components["schemas"]["v1ConsentEntry"][];
+        };
+        /** @description A registered OAuth 2.0 client. */
+        v1OAuthClient: {
+            client_id?: string;
+            client_name?: string;
+            redirect_uris?: string[];
+            /** Format: int64 */
+            created_at?: number;
+            is_confidential?: boolean;
+            grant_types?: string[];
+            access_token_authorization?: components["schemas"]["v1AccessTokenAuthorization"];
+            /** @description The algorithm this client's ID tokens are signed with: "RS256" or "EdDSA". */
+            id_token_signed_response_alg?: string;
+            /**
+             * @description The client secret Hearth generated for a confidential client. Present
+             *     only in the response that created the client (token_endpoint_auth_method
+             *     "client_secret_basic" or "client_secret_post"); never returned again.
+             *     Store it on receipt: Hearth keeps only its hash. Also set, once, by
+             *     RegenerateApplicationSecret.
+             */
+            client_secret?: string;
+            /**
+             * @description RFC 9449 s5.2: when true, every token request from this client must carry
+             *     a DPoP proof, and every token it gets is bound to the proof's key.
+             */
+            dpop_bound_access_tokens?: boolean;
+        };
+        /** @description A cursor-based page of OAuth clients. */
+        v1OAuthClientPage: {
+            items?: components["schemas"]["v1OAuthClient"][];
+            next_cursor?: string;
+        };
+        /** @description A realm record. */
+        v1Realm: {
+            id?: string;
+            name?: string;
+            status?: components["schemas"]["v1RealmStatus"];
+            config?: components["schemas"]["v1RealmConfig"];
+            /** Format: int64 */
+            created_at?: number;
+            /** Format: int64 */
+            updated_at?: number;
+        };
+        /** @description Per-realm configuration overrides. */
+        v1RealmConfig: {
+            /** Format: int64 */
+            session_ttl_micros?: number;
+            /** Format: int64 */
+            password_memory_cost?: number;
+            /** Format: int64 */
+            password_time_cost?: number;
+        };
+        /** @description A cursor-based page of realms. */
+        v1RealmPage: {
+            items?: components["schemas"]["v1Realm"][];
+            next_cursor?: string;
+        };
+        /**
+         * @description The lifecycle status of a realm.
+         * @default REALM_STATUS_UNSPECIFIED
+         * @enum {string}
+         */
+        v1RealmStatus: "REALM_STATUS_UNSPECIFIED" | "REALM_STATUS_ACTIVE" | "REALM_STATUS_SUSPENDED";
+        /** @description Request to register a new OAuth 2.0 client. */
+        v1RegisterClientRequest: {
+            client_name?: string;
+            redirect_uris?: string[];
+            /**
+             * @description Not accepted on the admin create paths (REST and gRPC refuse it): Hearth
+             *     generates client secrets. Request one with token_endpoint_auth_method.
+             */
+            client_secret?: string;
+            grant_types?: string[];
+            access_token_authorization?: components["schemas"]["v1AccessTokenAuthorization"];
+            /**
+             * @description Trust level for this client.  Unspecified defaults to ThirdParty on the
+             *     DCR path.  The authenticated admin create path respects this field.
+             */
+            trust_level?: components["schemas"]["v1ClientTrustLevel"];
+            /**
+             * @description JWS algorithm for this client's ID tokens (OIDC Dynamic Client
+             *     Registration 1.0 s2): "RS256" or "EdDSA"; anything else is rejected.
+             *     Omitted means RS256 on the dynamic registration path (the OIDC default)
+             *     and EdDSA on the authenticated admin path. Only ID tokens are affected;
+             *     access and refresh tokens are always EdDSA.
+             */
+            id_token_signed_response_alg?: string;
+            /**
+             * @description How the client authenticates at the token endpoint (RFC 7591 s2):
+             *     "client_secret_basic", "client_secret_post", "private_key_jwt" or "none".
+             *     On the authenticated admin create paths (POST /admin/applications,
+             *     POST /clients, gRPC CreateApplication and RegisterClient) a
+             *     "client_secret_*" value creates a confidential client whose secret Hearth
+             *     generates (256 bits from the OS CSPRNG) and returns exactly once, in the
+             *     response's client_secret. Only a hash is stored. "private_key_jwt"
+             *     requires jwks. Omitted or "none" registers a public client (or a
+             *     private_key_jwt client when jwks is given).
+             * @enum {string}
+             */
+            token_endpoint_auth_method?: "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+        };
+        v1ResolveEffectivePermissionsResponse: {
+            roles?: string[];
+            groups?: string[];
+            permissions?: string[];
+        };
+        v1RevokeConsentResponse: Record<string, never>;
+        /** @description Request to update an existing OAuth 2.0 client. */
+        v1UpdateClientRequest: {
+            client_name?: string;
+            redirect_uris?: string[];
+            grant_types?: string[];
+            access_token_authorization?: components["schemas"]["v1AccessTokenAuthorization"];
+            /** @description Trust level override.  Omit to leave unchanged. */
+            trust_level?: components["schemas"]["v1ClientTrustLevel"];
+            /** @description ID-token signing algorithm: "RS256" or "EdDSA". Omit to leave unchanged. */
+            id_token_signed_response_alg?: string;
+        };
+        /** @description Request to update an existing user. */
+        v1UpdateUserRequest: {
+            email?: string;
+            display_name?: string;
+            status?: components["schemas"]["v1UserStatus"];
+            first_name?: string;
+            last_name?: string;
+            /**
+             * @description When non-empty, replaces the user's entire custom attribute map.
+             *     An empty map is treated as "no change"; use clear_attributes to remove all.
+             */
+            attributes?: {
+                [key: string]: string;
+            };
+            /** @description When true and attributes is empty, clears all custom attributes. */
+            clear_attributes?: boolean;
+        };
+        /** @description A user record within a realm. */
+        v1User: {
+            id?: string;
+            email?: string;
+            display_name?: string;
+            status?: components["schemas"]["v1UserStatus"];
+            /** Format: int64 */
+            created_at?: number;
+            /** Format: int64 */
+            updated_at?: number;
+            first_name?: string;
+            last_name?: string;
+            /**
+             * @description Actions the user must complete before full access is granted.
+             *     Values: "VERIFY_EMAIL", "UPDATE_PASSWORD".
+             */
+            required_actions?: string[];
+        };
+        /** @description A cursor-based page of users. */
+        v1UserPage: {
+            items?: components["schemas"]["v1User"][];
+            next_cursor?: string;
+        };
+        /**
+         * @description The lifecycle status of a user account.
+         * @default USER_STATUS_UNSPECIFIED
+         * @enum {string}
+         */
+        v1UserStatus: "USER_STATUS_UNSPECIFIED" | "USER_STATUS_ACTIVE" | "USER_STATUS_DISABLED" | "USER_STATUS_PENDING_VERIFICATION";
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    ApplicationAdminService_ListApplications: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1OAuthClientPage"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    ApplicationAdminService_CreateApplication: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["v1RegisterClientRequest"];
+            };
+        };
+        responses: {
+            /** @description A successful response. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1OAuthClient"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    ApplicationAdminService_GetApplication: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1OAuthClient"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    ApplicationAdminService_DeleteApplication: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    ApplicationAdminService_UpdateApplication: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["v1UpdateClientRequest"];
+            };
+        };
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1OAuthClient"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    ApplicationAdminService_RegenerateApplicationSecret: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1OAuthClient"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    adminUnassignRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Assignment removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListAuditEvents: {
+        parameters: {
+            query?: {
+                actor?: string;
+                /** @description An audit action name, e.g. `UserCreated`. */
+                action?: string;
+                /** @description Microseconds since the Unix epoch. */
+                start_time?: number;
+                /** @description Microseconds since the Unix epoch. */
+                end_time?: number;
+                /** @description Default 50, at most 200. */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Matching audit events */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuditEventList"];
+                };
+            };
+            /** @description `start_time` is after `end_time` */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminVerifyAudit: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{ok, event_count}` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminBackupCreate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Backup archive */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminBackupRestore: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/octet-stream": string;
+            };
+        };
+        responses: {
+            /** @description Restore complete */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminBootstrap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Bootstrap result with dev-realm and system-realm admin tokens */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description UUID of the created dev realm. */
+                        realm_id?: string;
+                        /** @description UUID of the admin user in the dev realm. */
+                        user_id?: string;
+                        /**
+                         * @description Long-lived Bearer token for the dev-realm admin. Scoped to the dev
+                         *     realm only — cannot manage other realms. Use for REST API calls in
+                         *     dev/test scripts and as the `Authorization` header on re-bootstrap.
+                         */
+                        access_token?: string;
+                        /** @description Refresh token for the dev-realm admin session. */
+                        refresh_token?: string;
+                        /**
+                         * @description Randomly generated admin password. Non-empty **only** on the **first**
+                         *     bootstrap call. Empty on all subsequent re-bootstrap calls — store this
+                         *     value securely; it is never returned again. Use for browser login at
+                         *     `/ui/admin/login`.
+                         */
+                        admin_password?: string;
+                        /**
+                         * @description Ready-to-copy shell commands with the actual realm ID and token
+                         *     interpolated for convenience. Only populated in --dev mode.
+                         */
+                        quickstart?: string;
+                        /**
+                         * @description Bearer token for the **system-realm** admin (`admin@hearth.test` in the
+                         *     nil-UUID system realm). Unlike `access_token`, this token can manage
+                         *     **any** realm cross-realm (e.g. rotate another realm's signing key) — the
+                         *     BOLA guard only permits cross-realm operations for a nil-UUID system-realm
+                         *     token. Use with `X-Realm-ID: <system_realm_id>` for cross-realm admin API
+                         *     calls. Populated on every bootstrap and re-bootstrap (HEA-2087).
+                         */
+                        system_access_token?: string;
+                        /**
+                         * @description The reserved system realm ID (the nil UUID,
+                         *     `00000000-0000-0000-0000-000000000000`). Send as the `X-Realm-ID` header
+                         *     alongside `system_access_token` for cross-realm admin API calls.
+                         */
+                        system_realm_id?: string;
+                    };
+                };
+            };
+            /** @description Endpoint not available in production mode. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminClusterBootstrap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Cluster bootstrapped */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminClusterStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Cluster status */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminClusterTransferLeadership: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Another voter now leads; body is {"new_leader_id":<u64>,"exact_target":false}. exact_target is deprecated and always false (a request naming a target is refused with 422). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Body is not valid JSON or contains an unknown field */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description This node is not the leader */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description target_node_id was supplied; targeted leadership transfer is not supported */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not in cluster mode */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListGroups: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page of groups */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroupPage"];
+                };
+            };
+        };
+    };
+    adminCreateGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminCreateGroupRequest"];
+            };
+        };
+        responses: {
+            /** @description The created group */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroup"];
+                };
+            };
+            /** @description A group with this slug exists */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGetGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The group */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroup"];
+                };
+            };
+            /** @description No such group in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminDeleteGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such group in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminUpdateGroup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminUpdateGroupRequest"];
+            };
+        };
+        responses: {
+            /** @description The updated group */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroup"];
+                };
+            };
+            /** @description No such group in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListGroupMembers: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page of members */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroupMemberPage"];
+                };
+            };
+            /** @description No such group in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminAddGroupMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAddGroupMemberRequest"];
+            };
+        };
+        responses: {
+            /** @description The new membership */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminGroupMembership"];
+                };
+            };
+            /** @description Invalid member type or id */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such group in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminRemoveGroupMember: {
+        parameters: {
+            query?: {
+                /** @description Member kind; defaults to `user`. */
+                type?: "user" | "group";
+            };
+            header?: never;
+            path: {
+                id: string;
+                member_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Member removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid member type */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminAssignGroupRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The role assignment */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The role holds permissions the caller lacks */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such group or organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListOrganizations: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page of organizations; `next_cursor` is null on the last page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrganizationPage"];
+                };
+            };
+        };
+    };
+    adminCreateOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminCreateOrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description The created organization */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrganization"];
+                };
+            };
+            /** @description Missing `hearth.realm.admin`, or the system realm */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGetOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrganization"];
+                };
+            };
+            /** @description No such organization in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminDeleteOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Admin privilege ceiling */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminUpdateOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminUpdateOrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description The updated organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrganization"];
+                };
+            };
+            /** @description A slug change or an unknown status */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description A member holds admin authority the caller lacks */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListAdditionalRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The member's extra org role names */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRoleNameList"];
+                };
+            };
+        };
+    };
+    adminAddAdditionalRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAddAdditionalRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description Added */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The role holds permissions the caller lacks */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such organization, user or role */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The user is not a member of the organization */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminRemoveAdditionalRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                user_id: string;
+                role_name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListPermissions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{items: [{name, status}]}` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IdentityAdminService_ListRealms: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1RealmPage"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    IdentityAdminService_GetRealm: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1Realm"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    IdentityAdminService_DeleteRealm: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1Empty"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    adminGetRealmBranding: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Branding config */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminPatchRealmBranding: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Updated branding config */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListRealmEmailTemplates: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of email templates */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGetRealmEmailTemplate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                kind: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Email template */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminPutRealmEmailTemplate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                kind: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Updated template */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminDeleteRealmEmailTemplate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                kind: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Template deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminRotateRealmSigningKey: {
+        parameters: {
+            query?: {
+                /** @description Seconds the retired key stays valid. Omit, or pass 0, to revoke it immediately. A value that is not a non-negative integer is rejected with 400. */
+                grace_period_secs?: number;
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description New signing key published */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description grace_period_secs was not a non-negative integer */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IdentityAdminService_SuspendRealm: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The realm, now suspended */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1Realm"];
+                };
+            };
+            /** @description Not a system-realm hearth.realm.admin, the target is the system realm, or the target's trust policy refuses the crossing */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Realm not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The realm is archived or being deleted (HEARTH_REALM_ARCHIVED) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IdentityAdminService_UnsuspendRealm: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The realm, now active */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1Realm"];
+                };
+            };
+            /** @description Not a system-realm hearth.realm.admin, or the target's trust policy refuses the crossing */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Realm not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The realm is archived or being deleted (HEARTH_REALM_ARCHIVED) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminPatchRealmConfig: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                realm_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Updated config */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminSvBumpAll: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                realm_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description All session versions bumped */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminPatchUserRequiredActions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                realm_id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Updated required actions */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListRoles: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page of roles */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRolePage"];
+                };
+            };
+        };
+    };
+    adminCreateRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminCreateRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description The created role */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRole"];
+                };
+            };
+            /** @description Invalid name, permission or parent role */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description A role with this name exists */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGetRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRole"];
+                };
+            };
+            /** @description No such role in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminDeleteRole: {
+        parameters: {
+            query?: {
+                /** @description Also remove the role's assignments, parent links and extra org-role rows. Without it a referenced role answers `409 role_in_use`. */
+                cascade?: boolean;
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such role in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The role is in use and `cascade` is not set */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminUpdateRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminUpdateRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description The updated role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRole"];
+                };
+            };
+            /** @description No such role in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListRoleMembers: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{items: [{subject_type, subject_id}], next_cursor}` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminSvBumpSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                session_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Session version bumped */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IdentityAdminService_ListUsers: {
+        parameters: {
+            query?: {
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1UserPage"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    IdentityAdminService_CreateUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["v1CreateUserRequest"];
+            };
+        };
+        responses: {
+            /** @description A successful response. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1User"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    adminBulkUsers: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Bulk operation result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminExportUsers: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Exported users */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminImportUsers: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Import result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IdentityAdminService_GetUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1User"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    IdentityAdminService_DeleteUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    IdentityAdminService_UpdateUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["v1UpdateUserRequest"];
+            };
+        };
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1User"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    adminListUserPermissions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description `{items: [{permission, scope_type, org_id, granted_by, granted_at}]}` */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGrantUserPermission: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The grant */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The caller does not hold the permission */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such user or organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminRevokeUserPermission: {
+        parameters: {
+            query?: {
+                org_id?: string;
+            };
+            header?: never;
+            path: {
+                id: string;
+                permission: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Admin privilege ceiling */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListUserAssignments: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The user's direct role assignments */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRoleAssignmentList"];
+                };
+            };
+            /** @description No such user in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminAssignUserRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAssignRoleRequest"];
+            };
+        };
+        responses: {
+            /** @description The new assignment */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminRoleAssignment"];
+                };
+            };
+            /** @description The role holds permissions the caller lacks */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such user or role in the realm */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    RbacAdminService_ListUserConsents: {
+        parameters: {
+            query?: {
+                realm_id?: string;
+            };
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1ListUserConsentsResponse"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    RbacAdminService_RevokeConsent: {
+        parameters: {
+            query?: {
+                realm_id?: string;
+            };
+            header?: never;
+            path: {
+                user_id: string;
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1RevokeConsentResponse"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    RbacAdminService_ResolveEffectivePermissions: {
+        parameters: {
+            query?: {
+                realm_id?: string;
+                /** @description optional; empty means realm-only */
+                org_id?: string;
+                /** @description optional; empty means no narrowing */
+                scope?: string;
+            };
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A successful response. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["v1ResolveEffectivePermissionsResponse"];
+                };
+            };
+            /** @description An unexpected error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["rpcStatus"];
+                };
+            };
+        };
+    };
+    adminListWebhooks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of webhooks */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminCreateWebhook: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Webhook created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminGetWebhook: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Webhook */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminUpdateWebhook: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Updated webhook */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminDeleteWebhook: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Webhook deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminListWebhookDeliveries: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of delivery attempts */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+}