@homeflare/distilled-openbao 0.2.0

package/src/services/mfa.ts

@@ -0,0 +1,1193 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface MfaAdminDestroyTotpSecretRequest {
+  /** Identifier of the entity from which the MFA method secret needs to be removed. */
+  entity_id: string;
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaAdminDestroyTotpSecretRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    entity_id: S.String,
+    method_id: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/totp/admin-destroy",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaAdminDestroyTotpSecretRequest",
+}) as any as S.Schema<MfaAdminDestroyTotpSecretRequest>;
+
+export interface MfaAdminDestroyTotpSecretResponse {}
+export const MfaAdminDestroyTotpSecretResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaAdminDestroyTotpSecretResponse",
+}) as any as S.Schema<MfaAdminDestroyTotpSecretResponse>;
+
+export interface MfaAdminGenerateTotpSecretRequest {
+  /** Entity ID on which the generated secret needs to get stored. */
+  entity_id: string;
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaAdminGenerateTotpSecretRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    entity_id: S.String,
+    method_id: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/totp/admin-generate",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaAdminGenerateTotpSecretRequest",
+}) as any as S.Schema<MfaAdminGenerateTotpSecretRequest>;
+
+export interface MfaAdminGenerateTotpSecretResponse {}
+export const MfaAdminGenerateTotpSecretResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaAdminGenerateTotpSecretResponse",
+}) as any as S.Schema<MfaAdminGenerateTotpSecretResponse>;
+
+export interface MfaConfigureDuoMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+  /** API host name for Duo. */
+  api_hostname?: string;
+  /** Integration key for Duo. */
+  integration_key?: string;
+  /** The unique name identifier for this MFA method. */
+  method_name?: string;
+  /** Push information for Duo. */
+  push_info?: string;
+  /** Secret key for Duo. */
+  secret_key?: string;
+  /** If true, the user is reminded to use the passcode upon MFA validation. This option does not enforce using the passcode. Defaults to false. */
+  use_passcode?: boolean;
+  /** A template string for mapping Identity names to MFA method names. Values to subtitute should be placed in {{}}. For example, "{{alias.name}}@example.com". Currently-supported mappings: alias.name: The name returned by the mount configured via the mount_accessor parameter If blank, the Alias's name field will be used as-is. */
+  username_format?: string;
+}
+export const MfaConfigureDuoMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+    api_hostname: S.optional(S.String),
+    integration_key: S.optional(S.String),
+    method_name: S.optional(S.String),
+    push_info: S.optional(S.String),
+    secret_key: S.optional(S.String),
+    use_passcode: S.optional(S.Boolean),
+    username_format: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/duo/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaConfigureDuoMethodRequest",
+}) as any as S.Schema<MfaConfigureDuoMethodRequest>;
+
+export interface MfaConfigureDuoMethodResponse {}
+export const MfaConfigureDuoMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaConfigureDuoMethodResponse",
+}) as any as S.Schema<MfaConfigureDuoMethodResponse>;
+
+export interface MfaConfigureOktaMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+  /** Okta API key. */
+  api_token?: string;
+  /** The base domain to use for the Okta API. When not specified in the configuration, "okta.com" is used. */
+  base_url?: string;
+  /** The unique name identifier for this MFA method. */
+  method_name?: string;
+  /** Name of the organization to be used in the Okta API. */
+  org_name?: string;
+  /** If true, the username will only match the primary email for the account. Defaults to false. */
+  primary_email?: boolean;
+  /** (DEPRECATED) Use base_url instead. */
+  production?: boolean;
+  /** A template string for mapping Identity names to MFA method names. Values to substitute should be placed in {{}}. For example, "{{entity.name}}@example.com". If blank, the Entity's name field will be used as-is. */
+  username_format?: string;
+}
+export const MfaConfigureOktaMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+    api_token: S.optional(S.String),
+    base_url: S.optional(S.String),
+    method_name: S.optional(S.String),
+    org_name: S.optional(S.String),
+    primary_email: S.optional(S.Boolean),
+    production: S.optional(S.Boolean),
+    username_format: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/okta/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaConfigureOktaMethodRequest",
+}) as any as S.Schema<MfaConfigureOktaMethodRequest>;
+
+export interface MfaConfigureOktaMethodResponse {}
+export const MfaConfigureOktaMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaConfigureOktaMethodResponse",
+}) as any as S.Schema<MfaConfigureOktaMethodResponse>;
+
+export interface MfaConfigurePingIdMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+  /** The unique name identifier for this MFA method. */
+  method_name?: string;
+  /** The settings file provided by Ping, Base64-encoded. This must be a settings file suitable for third-party clients, not the PingID SDK or PingFederate. */
+  settings_file_base64?: string;
+  /** A template string for mapping Identity names to MFA method names. Values to subtitute should be placed in {{}}. For example, "{{alias.name}}@example.com". Currently-supported mappings: alias.name: The name returned by the mount configured via the mount_accessor parameter If blank, the Alias's name field will be used as-is. */
+  username_format?: string;
+}
+export const MfaConfigurePingIdMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+    method_name: S.optional(S.String),
+    settings_file_base64: S.optional(S.String),
+    username_format: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/pingid/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaConfigurePingIdMethodRequest",
+}) as any as S.Schema<MfaConfigurePingIdMethodRequest>;
+
+export interface MfaConfigurePingIdMethodResponse {}
+export const MfaConfigurePingIdMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaConfigurePingIdMethodResponse",
+}) as any as S.Schema<MfaConfigurePingIdMethodResponse>;
+
+export interface MfaConfigureTotpMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+  /** The hashing algorithm used to generate the TOTP token. Options include SHA1, SHA256 and SHA512. */
+  algorithm?: string;
+  /** The number of digits in the generated TOTP token. This value can either be 6 or 8. */
+  digits?: number;
+  /** The name of the key's issuing organization. */
+  issuer?: string;
+  /** Determines the size in bytes of the generated key. */
+  key_size?: number;
+  /** Max number of allowed validation attempts. */
+  max_validation_attempts?: number;
+  /** The unique name identifier for this MFA method. */
+  method_name?: string;
+  /** The length of time used to generate a counter for the TOTP token calculation. */
+  period?: number;
+  /** The pixel size of the generated square QR code. */
+  qr_size?: number;
+  /** The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1. */
+  skew?: number;
+}
+export const MfaConfigureTotpMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+    algorithm: S.optional(S.String),
+    digits: S.optional(S.Number),
+    issuer: S.optional(S.String),
+    key_size: S.optional(S.Number),
+    max_validation_attempts: S.optional(S.Number),
+    method_name: S.optional(S.String),
+    period: S.optional(S.Number),
+    qr_size: S.optional(S.Number),
+    skew: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/totp/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaConfigureTotpMethodRequest",
+}) as any as S.Schema<MfaConfigureTotpMethodRequest>;
+
+export interface MfaConfigureTotpMethodResponse {}
+export const MfaConfigureTotpMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaConfigureTotpMethodResponse",
+}) as any as S.Schema<MfaConfigureTotpMethodResponse>;
+
+export interface MfaDeleteDuoMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaDeleteDuoMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/mfa/method/duo/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaDeleteDuoMethodRequest",
+}) as any as S.Schema<MfaDeleteDuoMethodRequest>;
+
+export interface MfaDeleteDuoMethodResponse {}
+export const MfaDeleteDuoMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaDeleteDuoMethodResponse",
+}) as any as S.Schema<MfaDeleteDuoMethodResponse>;
+
+export interface MfaDeleteLoginEnforcementRequest {
+  /** Name for this login enforcement configuration */
+  name: string;
+}
+export const MfaDeleteLoginEnforcementRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/mfa/login-enforcement/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaDeleteLoginEnforcementRequest",
+}) as any as S.Schema<MfaDeleteLoginEnforcementRequest>;
+
+export interface MfaDeleteLoginEnforcementResponse {}
+export const MfaDeleteLoginEnforcementResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaDeleteLoginEnforcementResponse",
+}) as any as S.Schema<MfaDeleteLoginEnforcementResponse>;
+
+export interface MfaDeleteOktaMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaDeleteOktaMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/mfa/method/okta/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaDeleteOktaMethodRequest",
+}) as any as S.Schema<MfaDeleteOktaMethodRequest>;
+
+export interface MfaDeleteOktaMethodResponse {}
+export const MfaDeleteOktaMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaDeleteOktaMethodResponse",
+}) as any as S.Schema<MfaDeleteOktaMethodResponse>;
+
+export interface MfaDeletePingIdMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaDeletePingIdMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/mfa/method/pingid/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaDeletePingIdMethodRequest",
+}) as any as S.Schema<MfaDeletePingIdMethodRequest>;
+
+export interface MfaDeletePingIdMethodResponse {}
+export const MfaDeletePingIdMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaDeletePingIdMethodResponse",
+}) as any as S.Schema<MfaDeletePingIdMethodResponse>;
+
+export interface MfaDeleteTotpMethodRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaDeleteTotpMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/mfa/method/totp/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaDeleteTotpMethodRequest",
+}) as any as S.Schema<MfaDeleteTotpMethodRequest>;
+
+export interface MfaDeleteTotpMethodResponse {}
+export const MfaDeleteTotpMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaDeleteTotpMethodResponse",
+}) as any as S.Schema<MfaDeleteTotpMethodResponse>;
+
+export interface MfaGenerateTotpSecretRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaGenerateTotpSecretRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/method/totp/generate",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaGenerateTotpSecretRequest",
+}) as any as S.Schema<MfaGenerateTotpSecretRequest>;
+
+export interface MfaGenerateTotpSecretResponse {}
+export const MfaGenerateTotpSecretResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaGenerateTotpSecretResponse",
+}) as any as S.Schema<MfaGenerateTotpSecretResponse>;
+
+export type MfaListDuoMethodsRequestList = "true";
+export const MfaListDuoMethodsRequestList = S.String;
+
+export interface MfaListDuoMethodsRequest {
+  /** Must be set to `true` */
+  list: MfaListDuoMethodsRequestList | (string & {});
+}
+export const MfaListDuoMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListDuoMethodsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/mfa/method/duo", code: 200 }),
+  ),
+).annotate({
+  identifier: "MfaListDuoMethodsRequest",
+}) as any as S.Schema<MfaListDuoMethodsRequest>;
+
+export interface MfaListDuoMethodsResponse {}
+export const MfaListDuoMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListDuoMethodsResponse",
+}) as any as S.Schema<MfaListDuoMethodsResponse>;
+
+export type MfaListLoginEnforcementsRequestList = "true";
+export const MfaListLoginEnforcementsRequestList = S.String;
+
+export interface MfaListLoginEnforcementsRequest {
+  /** Must be set to `true` */
+  list: MfaListLoginEnforcementsRequestList | (string & {});
+}
+export const MfaListLoginEnforcementsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListLoginEnforcementsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/mfa/login-enforcement",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaListLoginEnforcementsRequest",
+}) as any as S.Schema<MfaListLoginEnforcementsRequest>;
+
+export interface MfaListLoginEnforcementsResponse {}
+export const MfaListLoginEnforcementsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListLoginEnforcementsResponse",
+}) as any as S.Schema<MfaListLoginEnforcementsResponse>;
+
+export type MfaListMethodsRequestList = "true";
+export const MfaListMethodsRequestList = S.String;
+
+export interface MfaListMethodsRequest {
+  /** Must be set to `true` */
+  list: MfaListMethodsRequestList | (string & {});
+}
+export const MfaListMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListMethodsRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/mfa/method", code: 200 })),
+).annotate({
+  identifier: "MfaListMethodsRequest",
+}) as any as S.Schema<MfaListMethodsRequest>;
+
+export interface MfaListMethodsResponse {}
+export const MfaListMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListMethodsResponse",
+}) as any as S.Schema<MfaListMethodsResponse>;
+
+export type MfaListOktaMethodsRequestList = "true";
+export const MfaListOktaMethodsRequestList = S.String;
+
+export interface MfaListOktaMethodsRequest {
+  /** Must be set to `true` */
+  list: MfaListOktaMethodsRequestList | (string & {});
+}
+export const MfaListOktaMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListOktaMethodsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/mfa/method/okta", code: 200 }),
+  ),
+).annotate({
+  identifier: "MfaListOktaMethodsRequest",
+}) as any as S.Schema<MfaListOktaMethodsRequest>;
+
+export interface MfaListOktaMethodsResponse {}
+export const MfaListOktaMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListOktaMethodsResponse",
+}) as any as S.Schema<MfaListOktaMethodsResponse>;
+
+export type MfaListPingIdMethodsRequestList = "true";
+export const MfaListPingIdMethodsRequestList = S.String;
+
+export interface MfaListPingIdMethodsRequest {
+  /** Must be set to `true` */
+  list: MfaListPingIdMethodsRequestList | (string & {});
+}
+export const MfaListPingIdMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListPingIdMethodsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/mfa/method/pingid", code: 200 }),
+  ),
+).annotate({
+  identifier: "MfaListPingIdMethodsRequest",
+}) as any as S.Schema<MfaListPingIdMethodsRequest>;
+
+export interface MfaListPingIdMethodsResponse {}
+export const MfaListPingIdMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListPingIdMethodsResponse",
+}) as any as S.Schema<MfaListPingIdMethodsResponse>;
+
+export type MfaListTotpMethodsRequestList = "true";
+export const MfaListTotpMethodsRequestList = S.String;
+
+export interface MfaListTotpMethodsRequest {
+  /** Must be set to `true` */
+  list: MfaListTotpMethodsRequestList | (string & {});
+}
+export const MfaListTotpMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: MfaListTotpMethodsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/mfa/method/totp", code: 200 }),
+  ),
+).annotate({
+  identifier: "MfaListTotpMethodsRequest",
+}) as any as S.Schema<MfaListTotpMethodsRequest>;
+
+export interface MfaListTotpMethodsResponse {}
+export const MfaListTotpMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaListTotpMethodsResponse",
+}) as any as S.Schema<MfaListTotpMethodsResponse>;
+
+export interface MfaReadDuoMethodConfigurationRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaReadDuoMethodConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      method_id: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/identity/mfa/method/duo/{method_id}",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "MfaReadDuoMethodConfigurationRequest",
+}) as any as S.Schema<MfaReadDuoMethodConfigurationRequest>;
+
+export interface MfaReadDuoMethodConfigurationResponse {}
+export const MfaReadDuoMethodConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "MfaReadDuoMethodConfigurationResponse",
+}) as any as S.Schema<MfaReadDuoMethodConfigurationResponse>;
+
+export interface MfaReadLoginEnforcementRequest {
+  /** Name for this login enforcement configuration */
+  name: string;
+}
+export const MfaReadLoginEnforcementRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/mfa/login-enforcement/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaReadLoginEnforcementRequest",
+}) as any as S.Schema<MfaReadLoginEnforcementRequest>;
+
+export interface MfaReadLoginEnforcementResponse {}
+export const MfaReadLoginEnforcementResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaReadLoginEnforcementResponse",
+}) as any as S.Schema<MfaReadLoginEnforcementResponse>;
+
+export interface MfaReadMethodConfigurationRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaReadMethodConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    method_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/mfa/method/{method_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaReadMethodConfigurationRequest",
+}) as any as S.Schema<MfaReadMethodConfigurationRequest>;
+
+export interface MfaReadMethodConfigurationResponse {}
+export const MfaReadMethodConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaReadMethodConfigurationResponse",
+}) as any as S.Schema<MfaReadMethodConfigurationResponse>;
+
+export interface MfaReadOktaMethodConfigurationRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaReadOktaMethodConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      method_id: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/identity/mfa/method/okta/{method_id}",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "MfaReadOktaMethodConfigurationRequest",
+}) as any as S.Schema<MfaReadOktaMethodConfigurationRequest>;
+
+export interface MfaReadOktaMethodConfigurationResponse {}
+export const MfaReadOktaMethodConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "MfaReadOktaMethodConfigurationResponse",
+}) as any as S.Schema<MfaReadOktaMethodConfigurationResponse>;
+
+export interface MfaReadPingIdMethodConfigurationRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaReadPingIdMethodConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      method_id: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/identity/mfa/method/pingid/{method_id}",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "MfaReadPingIdMethodConfigurationRequest",
+}) as any as S.Schema<MfaReadPingIdMethodConfigurationRequest>;
+
+export interface MfaReadPingIdMethodConfigurationResponse {}
+export const MfaReadPingIdMethodConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "MfaReadPingIdMethodConfigurationResponse",
+}) as any as S.Schema<MfaReadPingIdMethodConfigurationResponse>;
+
+export interface MfaReadTotpMethodConfigurationRequest {
+  /** The unique identifier for this MFA method. */
+  method_id: string;
+}
+export const MfaReadTotpMethodConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      method_id: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/identity/mfa/method/totp/{method_id}",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "MfaReadTotpMethodConfigurationRequest",
+}) as any as S.Schema<MfaReadTotpMethodConfigurationRequest>;
+
+export interface MfaReadTotpMethodConfigurationResponse {}
+export const MfaReadTotpMethodConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "MfaReadTotpMethodConfigurationResponse",
+}) as any as S.Schema<MfaReadTotpMethodConfigurationResponse>;
+
+/** Array of auth mount accessor IDs */
+export type MfaWriteLoginEnforcementRequestAuthMethodAccessorsList =
+  Array<string>;
+export const MfaWriteLoginEnforcementRequestAuthMethodAccessorsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<MfaWriteLoginEnforcementRequestAuthMethodAccessorsList>;
+
+/** Array of auth mount types */
+export type MfaWriteLoginEnforcementRequestAuthMethodTypesList = Array<string>;
+export const MfaWriteLoginEnforcementRequestAuthMethodTypesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<MfaWriteLoginEnforcementRequestAuthMethodTypesList>;
+
+/** Array of identity entity IDs */
+export type MfaWriteLoginEnforcementRequestIdentityEntityIdsList =
+  Array<string>;
+export const MfaWriteLoginEnforcementRequestIdentityEntityIdsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<MfaWriteLoginEnforcementRequestIdentityEntityIdsList>;
+
+/** Array of identity group IDs */
+export type MfaWriteLoginEnforcementRequestIdentityGroupIdsList = Array<string>;
+export const MfaWriteLoginEnforcementRequestIdentityGroupIdsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<MfaWriteLoginEnforcementRequestIdentityGroupIdsList>;
+
+/** Array of Method IDs that determine what methods will be enforced */
+export type MfaWriteLoginEnforcementRequestMfaMethodIdsList = Array<string>;
+export const MfaWriteLoginEnforcementRequestMfaMethodIdsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<MfaWriteLoginEnforcementRequestMfaMethodIdsList>;
+
+export interface MfaWriteLoginEnforcementRequest {
+  /** Name for this login enforcement configuration */
+  name: string;
+  /** Array of auth mount accessor IDs */
+  auth_method_accessors?: MfaWriteLoginEnforcementRequestAuthMethodAccessorsList;
+  /** Array of auth mount types */
+  auth_method_types?: MfaWriteLoginEnforcementRequestAuthMethodTypesList;
+  /** Array of identity entity IDs */
+  identity_entity_ids?: MfaWriteLoginEnforcementRequestIdentityEntityIdsList;
+  /** Array of identity group IDs */
+  identity_group_ids?: MfaWriteLoginEnforcementRequestIdentityGroupIdsList;
+  /** Array of Method IDs that determine what methods will be enforced */
+  mfa_method_ids: MfaWriteLoginEnforcementRequestMfaMethodIdsList;
+}
+export const MfaWriteLoginEnforcementRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    auth_method_accessors: S.optional(
+      MfaWriteLoginEnforcementRequestAuthMethodAccessorsList,
+    ),
+    auth_method_types: S.optional(
+      MfaWriteLoginEnforcementRequestAuthMethodTypesList,
+    ),
+    identity_entity_ids: S.optional(
+      MfaWriteLoginEnforcementRequestIdentityEntityIdsList,
+    ),
+    identity_group_ids: S.optional(
+      MfaWriteLoginEnforcementRequestIdentityGroupIdsList,
+    ),
+    mfa_method_ids: MfaWriteLoginEnforcementRequestMfaMethodIdsList,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/mfa/login-enforcement/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "MfaWriteLoginEnforcementRequest",
+}) as any as S.Schema<MfaWriteLoginEnforcementRequest>;
+
+export interface MfaWriteLoginEnforcementResponse {}
+export const MfaWriteLoginEnforcementResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "MfaWriteLoginEnforcementResponse",
+}) as any as S.Schema<MfaWriteLoginEnforcementResponse>;
+
+export interface ValidateMfaRequest {
+  /** A map from MFA method ID to a slice of passcodes or an empty slice if the method does not use passcodes */
+  mfa_payload: unknown;
+  /** ID for this MFA request */
+  mfa_request_id: string;
+}
+export const ValidateMfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    mfa_payload: S.Unknown,
+    mfa_request_id: S.String,
+  }).pipe(T.Http({ method: "POST", uri: "/sys/mfa/validate", code: 200 })),
+).annotate({
+  identifier: "ValidateMfaRequest",
+}) as any as S.Schema<ValidateMfaRequest>;
+
+export interface ValidateMfaResponse {}
+export const ValidateMfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "ValidateMfaResponse",
+}) as any as S.Schema<ValidateMfaResponse>;
+
+export type MfaAdminDestroyTotpSecretError = OpenBaoOpError;
+/** Destroys a TOTP secret for the given MFA method ID on the given entity */
+export const mfaAdminDestroyTotpSecret: API.OperationMethod<
+  MfaAdminDestroyTotpSecretRequest,
+  MfaAdminDestroyTotpSecretResponse,
+  MfaAdminDestroyTotpSecretError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaAdminDestroyTotpSecretRequest,
+  output: MfaAdminDestroyTotpSecretResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaAdminGenerateTotpSecretError = OpenBaoOpError;
+/** Update or create TOTP secret for the given method ID on the given entity. */
+export const mfaAdminGenerateTotpSecret: API.OperationMethod<
+  MfaAdminGenerateTotpSecretRequest,
+  MfaAdminGenerateTotpSecretResponse,
+  MfaAdminGenerateTotpSecretError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaAdminGenerateTotpSecretRequest,
+  output: MfaAdminGenerateTotpSecretResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaConfigureDuoMethodError = OpenBaoOpError;
+/** Update or create a configuration for the given MFA method */
+export const mfaConfigureDuoMethod: API.OperationMethod<
+  MfaConfigureDuoMethodRequest,
+  MfaConfigureDuoMethodResponse,
+  MfaConfigureDuoMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaConfigureDuoMethodRequest,
+  output: MfaConfigureDuoMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaConfigureOktaMethodError = OpenBaoOpError;
+/** Update or create a configuration for the given MFA method */
+export const mfaConfigureOktaMethod: API.OperationMethod<
+  MfaConfigureOktaMethodRequest,
+  MfaConfigureOktaMethodResponse,
+  MfaConfigureOktaMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaConfigureOktaMethodRequest,
+  output: MfaConfigureOktaMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaConfigurePingIdMethodError = OpenBaoOpError;
+/** Update or create a configuration for the given MFA method */
+export const mfaConfigurePingIdMethod: API.OperationMethod<
+  MfaConfigurePingIdMethodRequest,
+  MfaConfigurePingIdMethodResponse,
+  MfaConfigurePingIdMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaConfigurePingIdMethodRequest,
+  output: MfaConfigurePingIdMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaConfigureTotpMethodError = OpenBaoOpError;
+/** Update or create a configuration for the given MFA method */
+export const mfaConfigureTotpMethod: API.OperationMethod<
+  MfaConfigureTotpMethodRequest,
+  MfaConfigureTotpMethodResponse,
+  MfaConfigureTotpMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaConfigureTotpMethodRequest,
+  output: MfaConfigureTotpMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaDeleteDuoMethodError = OpenBaoOpError;
+/** Delete a configuration for the given MFA method */
+export const mfaDeleteDuoMethod: API.OperationMethod<
+  MfaDeleteDuoMethodRequest,
+  MfaDeleteDuoMethodResponse,
+  MfaDeleteDuoMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaDeleteDuoMethodRequest,
+  output: MfaDeleteDuoMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaDeleteLoginEnforcementError = OpenBaoOpError;
+/** Delete a login enforcement */
+export const mfaDeleteLoginEnforcement: API.OperationMethod<
+  MfaDeleteLoginEnforcementRequest,
+  MfaDeleteLoginEnforcementResponse,
+  MfaDeleteLoginEnforcementError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaDeleteLoginEnforcementRequest,
+  output: MfaDeleteLoginEnforcementResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaDeleteOktaMethodError = OpenBaoOpError;
+/** Delete a configuration for the given MFA method */
+export const mfaDeleteOktaMethod: API.OperationMethod<
+  MfaDeleteOktaMethodRequest,
+  MfaDeleteOktaMethodResponse,
+  MfaDeleteOktaMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaDeleteOktaMethodRequest,
+  output: MfaDeleteOktaMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaDeletePingIdMethodError = OpenBaoOpError;
+/** Delete a configuration for the given MFA method */
+export const mfaDeletePingIdMethod: API.OperationMethod<
+  MfaDeletePingIdMethodRequest,
+  MfaDeletePingIdMethodResponse,
+  MfaDeletePingIdMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaDeletePingIdMethodRequest,
+  output: MfaDeletePingIdMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaDeleteTotpMethodError = OpenBaoOpError;
+/** Delete a configuration for the given MFA method */
+export const mfaDeleteTotpMethod: API.OperationMethod<
+  MfaDeleteTotpMethodRequest,
+  MfaDeleteTotpMethodResponse,
+  MfaDeleteTotpMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaDeleteTotpMethodRequest,
+  output: MfaDeleteTotpMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaGenerateTotpSecretError = OpenBaoOpError;
+/** Update or create TOTP secret for the given method ID on the given entity. */
+export const mfaGenerateTotpSecret: API.OperationMethod<
+  MfaGenerateTotpSecretRequest,
+  MfaGenerateTotpSecretResponse,
+  MfaGenerateTotpSecretError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaGenerateTotpSecretRequest,
+  output: MfaGenerateTotpSecretResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListDuoMethodsError = OpenBaoOpError;
+/** List MFA method configurations for the given MFA method */
+export const mfaListDuoMethods: API.OperationMethod<
+  MfaListDuoMethodsRequest,
+  MfaListDuoMethodsResponse,
+  MfaListDuoMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListDuoMethodsRequest,
+  output: MfaListDuoMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListLoginEnforcementsError = OpenBaoOpError;
+/** List login enforcements */
+export const mfaListLoginEnforcements: API.OperationMethod<
+  MfaListLoginEnforcementsRequest,
+  MfaListLoginEnforcementsResponse,
+  MfaListLoginEnforcementsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListLoginEnforcementsRequest,
+  output: MfaListLoginEnforcementsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListMethodsError = OpenBaoOpError;
+/** List MFA method configurations for all MFA methods */
+export const mfaListMethods: API.OperationMethod<
+  MfaListMethodsRequest,
+  MfaListMethodsResponse,
+  MfaListMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListMethodsRequest,
+  output: MfaListMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListOktaMethodsError = OpenBaoOpError;
+/** List MFA method configurations for the given MFA method */
+export const mfaListOktaMethods: API.OperationMethod<
+  MfaListOktaMethodsRequest,
+  MfaListOktaMethodsResponse,
+  MfaListOktaMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListOktaMethodsRequest,
+  output: MfaListOktaMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListPingIdMethodsError = OpenBaoOpError;
+/** List MFA method configurations for the given MFA method */
+export const mfaListPingIdMethods: API.OperationMethod<
+  MfaListPingIdMethodsRequest,
+  MfaListPingIdMethodsResponse,
+  MfaListPingIdMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListPingIdMethodsRequest,
+  output: MfaListPingIdMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaListTotpMethodsError = OpenBaoOpError;
+/** List MFA method configurations for the given MFA method */
+export const mfaListTotpMethods: API.OperationMethod<
+  MfaListTotpMethodsRequest,
+  MfaListTotpMethodsResponse,
+  MfaListTotpMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaListTotpMethodsRequest,
+  output: MfaListTotpMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadDuoMethodConfigurationError = OpenBaoOpError;
+/** Read the current configuration for the given MFA method */
+export const mfaReadDuoMethodConfiguration: API.OperationMethod<
+  MfaReadDuoMethodConfigurationRequest,
+  MfaReadDuoMethodConfigurationResponse,
+  MfaReadDuoMethodConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadDuoMethodConfigurationRequest,
+  output: MfaReadDuoMethodConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadLoginEnforcementError = OpenBaoOpError;
+/** Read the current login enforcement */
+export const mfaReadLoginEnforcement: API.OperationMethod<
+  MfaReadLoginEnforcementRequest,
+  MfaReadLoginEnforcementResponse,
+  MfaReadLoginEnforcementError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadLoginEnforcementRequest,
+  output: MfaReadLoginEnforcementResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadMethodConfigurationError = OpenBaoOpError;
+/** Read the current configuration for the given ID regardless of the MFA method type */
+export const mfaReadMethodConfiguration: API.OperationMethod<
+  MfaReadMethodConfigurationRequest,
+  MfaReadMethodConfigurationResponse,
+  MfaReadMethodConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadMethodConfigurationRequest,
+  output: MfaReadMethodConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadOktaMethodConfigurationError = OpenBaoOpError;
+/** Read the current configuration for the given MFA method */
+export const mfaReadOktaMethodConfiguration: API.OperationMethod<
+  MfaReadOktaMethodConfigurationRequest,
+  MfaReadOktaMethodConfigurationResponse,
+  MfaReadOktaMethodConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadOktaMethodConfigurationRequest,
+  output: MfaReadOktaMethodConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadPingIdMethodConfigurationError = OpenBaoOpError;
+/** Read the current configuration for the given MFA method */
+export const mfaReadPingIdMethodConfiguration: API.OperationMethod<
+  MfaReadPingIdMethodConfigurationRequest,
+  MfaReadPingIdMethodConfigurationResponse,
+  MfaReadPingIdMethodConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadPingIdMethodConfigurationRequest,
+  output: MfaReadPingIdMethodConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaReadTotpMethodConfigurationError = OpenBaoOpError;
+/** Read the current configuration for the given MFA method */
+export const mfaReadTotpMethodConfiguration: API.OperationMethod<
+  MfaReadTotpMethodConfigurationRequest,
+  MfaReadTotpMethodConfigurationResponse,
+  MfaReadTotpMethodConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaReadTotpMethodConfigurationRequest,
+  output: MfaReadTotpMethodConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type MfaWriteLoginEnforcementError = OpenBaoOpError;
+/** Create or update a login enforcement */
+export const mfaWriteLoginEnforcement: API.OperationMethod<
+  MfaWriteLoginEnforcementRequest,
+  MfaWriteLoginEnforcementResponse,
+  MfaWriteLoginEnforcementError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: MfaWriteLoginEnforcementRequest,
+  output: MfaWriteLoginEnforcementResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ValidateMfaError = OpenBaoOpError;
+/** Validates the login for the given MFA methods. Upon successful validation, it returns an auth response containing the client token */
+export const validateMfa: API.OperationMethod<
+  ValidateMfaRequest,
+  ValidateMfaResponse,
+  ValidateMfaError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ValidateMfaRequest,
+  output: ValidateMfaResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));