@homeflare/distilled-proxmox-backup 0.2.0

package/src/services/access.ts

@@ -0,0 +1,1787 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (apidoc.js, via scripts/apidoc.ts — see its header). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  ProxmoxBackupProtocol,
+  type ProxmoxBackupOpError,
+  type ProxmoxBackupOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { ProxmoxBackupOpError, ProxmoxBackupOpContext };
+
+export interface CreateAccessOpenidAuthUrlRequest {
+  /** Realm name. */
+  realm: string;
+  /** Redirection Url. The client should set this to used server url. */
+  redirect_url: string;
+}
+export const CreateAccessOpenidAuthUrlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String,
+    redirect_url: S.String.pipe(T.Body("redirect-url")),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/openid/auth-url",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessOpenidAuthUrlRequest",
+}) as any as S.Schema<CreateAccessOpenidAuthUrlRequest>;
+
+export type CreateAccessOpenidAuthUrlResponse = string;
+export const CreateAccessOpenidAuthUrlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.String.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "CreateAccessOpenidAuthUrlResponse",
+}) as any as S.Schema<CreateAccessOpenidAuthUrlResponse>;
+
+export interface CreateAccessTicketRequest {
+  /** Whether the HttpOnly authentication flow should be used. */
+  http_only?: string;
+  /** The secret password. This can also be a valid ticket. Only optional if the ticket is provided in a cookie header and only if the endpoint supports this. */
+  password?: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path'. */
+  path?: string;
+  /** Port for verifying terminal tickets. */
+  port?: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path'. */
+  privs?: string;
+  /** The signed TFA challenge string the user wants to respond to. */
+  tfa_challenge?: string;
+  /** User ID */
+  username: string;
+}
+export const CreateAccessTicketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    http_only: S.optional(S.String.pipe(T.Body("http-only"))),
+    password: S.optional(S.String),
+    path: S.optional(S.String),
+    port: S.optional(S.String),
+    privs: S.optional(S.String),
+    tfa_challenge: S.optional(S.String.pipe(T.Body("tfa-challenge"))),
+    username: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/ticket",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessTicketRequest",
+}) as any as S.Schema<CreateAccessTicketRequest>;
+
+export interface CreateAccessTicketResponse {
+  CSRFPreventionToken?: string;
+  ticket?: string;
+  ticket_info?: string;
+  username: string;
+}
+export const CreateAccessTicketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    CSRFPreventionToken: S.optional(S.String),
+    ticket: S.optional(S.String),
+    ticket_info: S.optional(S.String.pipe(T.Body("ticket-info"))),
+    username: S.String,
+  }),
+).annotate({
+  identifier: "CreateAccessTicketResponse",
+}) as any as S.Schema<CreateAccessTicketResponse>;
+
+export interface CreateAccessUserRequest {
+  /** Comment. */
+  comment?: string;
+  /** E-Mail Address. */
+  email?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account. */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  /** First name. */
+  firstname?: string;
+  /** Last name. */
+  lastname?: string;
+  /** User Password. */
+  password?: string;
+  /** User ID */
+  userid: string;
+}
+export const CreateAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+    firstname: S.optional(S.String),
+    lastname: S.optional(S.String),
+    password: S.optional(S.String),
+    userid: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/users",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessUserRequest",
+}) as any as S.Schema<CreateAccessUserRequest>;
+
+export interface CreateAccessUserResponse {}
+export const CreateAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessUserResponse",
+}) as any as S.Schema<CreateAccessUserResponse>;
+
+export interface CreateAccessVncticketRequest {
+  /** Authentication ID */
+  authid: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path'. */
+  path: string;
+  /** Port for verifying terminal tickets. */
+  port?: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path'. */
+  privs: string;
+  /** The VNC ticket */
+  vncticket: string;
+}
+export const CreateAccessVncticketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    authid: S.String,
+    path: S.String,
+    port: S.optional(S.String),
+    privs: S.String,
+    vncticket: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/vncticket",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessVncticketRequest",
+}) as any as S.Schema<CreateAccessVncticketRequest>;
+
+export interface CreateAccessVncticketResponse {}
+export const CreateAccessVncticketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessVncticketResponse",
+}) as any as S.Schema<CreateAccessVncticketResponse>;
+
+export interface DeleteAccessTfaRequest {
+  userid: string;
+  id: string;
+  /** Password. */
+  password?: string;
+}
+export const DeleteAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/access/tfa/{userid}/{id}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteAccessTfaRequest",
+}) as any as S.Schema<DeleteAccessTfaRequest>;
+
+export interface DeleteAccessTfaResponse {}
+export const DeleteAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessTfaResponse",
+}) as any as S.Schema<DeleteAccessTfaResponse>;
+
+export interface DeleteAccessTicketRequest {}
+export const DeleteAccessTicketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "DELETE", uri: "/access/ticket", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAccessTicketRequest",
+}) as any as S.Schema<DeleteAccessTicketRequest>;
+
+export interface DeleteAccessTicketResponse {}
+export const DeleteAccessTicketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessTicketResponse",
+}) as any as S.Schema<DeleteAccessTicketResponse>;
+
+export interface DeleteAccessUserRequest {
+  userid: string;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+}
+export const DeleteAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    digest: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/access/users/{userid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteAccessUserRequest",
+}) as any as S.Schema<DeleteAccessUserRequest>;
+
+export interface DeleteAccessUserResponse {}
+export const DeleteAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessUserResponse",
+}) as any as S.Schema<DeleteAccessUserResponse>;
+
+export interface DeleteAccessUserTokenRequest {
+  userid: string;
+  token_name: string;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+}
+export const DeleteAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    token_name: S.String.pipe(T.Label()),
+    digest: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/access/users/{userid}/token/{token-name}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteAccessUserTokenRequest",
+}) as any as S.Schema<DeleteAccessUserTokenRequest>;
+
+export interface DeleteAccessUserTokenResponse {}
+export const DeleteAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessUserTokenResponse",
+}) as any as S.Schema<DeleteAccessUserTokenResponse>;
+
+export interface GetAccessRequest {}
+export const GetAccessRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access", code: 200 })),
+).annotate({
+  identifier: "GetAccessRequest",
+}) as any as S.Schema<GetAccessRequest>;
+
+export interface GetAccessResponse {}
+export const GetAccessResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "GetAccessResponse",
+}) as any as S.Schema<GetAccessResponse>;
+
+export interface GetAccessOpenidRequest {}
+export const GetAccessOpenidRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/openid", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessOpenidRequest",
+}) as any as S.Schema<GetAccessOpenidRequest>;
+
+export interface GetAccessOpenidResponse {}
+export const GetAccessOpenidResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "GetAccessOpenidResponse",
+}) as any as S.Schema<GetAccessOpenidResponse>;
+
+export interface GetAccessPermissionsRequest {
+  /** Authentication ID */
+  auth_id?: string;
+  /** Access control path. */
+  path?: string;
+}
+export const GetAccessPermissionsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    auth_id: S.optional(S.String.pipe(T.Query("auth-id"))),
+    path: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/access/permissions", code: 200 })),
+).annotate({
+  identifier: "GetAccessPermissionsRequest",
+}) as any as S.Schema<GetAccessPermissionsRequest>;
+
+export type GetAccessPermissionsResponse = unknown;
+export const GetAccessPermissionsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "GetAccessPermissionsResponse",
+}) as any as S.Schema<GetAccessPermissionsResponse>;
+
+export interface GetAccessTfaRequest {
+  userid: string;
+}
+export const GetAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/tfa/{userid}", code: 200 })),
+).annotate({
+  identifier: "GetAccessTfaRequest",
+}) as any as S.Schema<GetAccessTfaRequest>;
+
+export type GetAccessTfaResponseBodyItemType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const GetAccessTfaResponseBodyItemType = S.String;
+
+export interface GetAccessTfaResponseBodyItem {
+  created: number;
+  description: string;
+  enable: unknown;
+  id: string;
+  type: GetAccessTfaResponseBodyItemType;
+}
+export const GetAccessTfaResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    created: S.Number,
+    description: S.String,
+    enable: S.Unknown,
+    id: S.String,
+    type: GetAccessTfaResponseBodyItemType,
+  }),
+).annotate({
+  identifier: "GetAccessTfaResponseBodyItem",
+}) as any as S.Schema<GetAccessTfaResponseBodyItem>;
+
+export type GetAccessTfaResponseBodyList = Array<GetAccessTfaResponseBodyItem>;
+export const GetAccessTfaResponseBodyList = /*@__PURE__*/ S.Array(
+  GetAccessTfaResponseBodyItem,
+) as any as S.Schema<GetAccessTfaResponseBodyList>;
+
+export type GetAccessTfaResponse = GetAccessTfaResponseBodyList;
+export const GetAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  GetAccessTfaResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "GetAccessTfaResponse",
+}) as any as S.Schema<GetAccessTfaResponse>;
+
+export interface GetAccessTfa2Request {
+  userid: string;
+  id: string;
+}
+export const GetAccessTfa2Request = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/tfa/{userid}/{id}", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessTfa2Request",
+}) as any as S.Schema<GetAccessTfa2Request>;
+
+export interface GetAccessTfa2Response {}
+export const GetAccessTfa2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "GetAccessTfa2Response",
+}) as any as S.Schema<GetAccessTfa2Response>;
+
+export interface GetAccessUserRequest {
+  userid: string;
+}
+export const GetAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/users/{userid}", code: 200 })),
+).annotate({
+  identifier: "GetAccessUserRequest",
+}) as any as S.Schema<GetAccessUserRequest>;
+
+export interface GetAccessUserResponse {
+  comment?: string;
+  email?: string;
+  enable?: unknown;
+  expire?: number;
+  firstname?: string;
+  lastname?: string;
+  userid: string;
+}
+export const GetAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    firstname: S.optional(S.String),
+    lastname: S.optional(S.String),
+    userid: S.String,
+  }),
+).annotate({
+  identifier: "GetAccessUserResponse",
+}) as any as S.Schema<GetAccessUserResponse>;
+
+export interface GetAccessUserTokenRequest {
+  userid: string;
+  token_name: string;
+}
+export const GetAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    token_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/access/users/{userid}/token/{token-name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "GetAccessUserTokenRequest",
+}) as any as S.Schema<GetAccessUserTokenRequest>;
+
+export interface GetAccessUserTokenResponse {
+  comment?: string;
+  enable?: unknown;
+  expire?: number;
+  tokenid: string;
+}
+export const GetAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    tokenid: S.String,
+  }),
+).annotate({
+  identifier: "GetAccessUserTokenResponse",
+}) as any as S.Schema<GetAccessUserTokenResponse>;
+
+export interface ListAccessAclRequest {
+  /** If set, returns only ACL for the exact path. */
+  exact?: string;
+  /** Access control path. */
+  path?: string;
+}
+export const ListAccessAclRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    exact: S.optional(S.String.pipe(T.Query())),
+    path: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/access/acl", code: 200 })),
+).annotate({
+  identifier: "ListAccessAclRequest",
+}) as any as S.Schema<ListAccessAclRequest>;
+
+export type ListAccessAclResponseBodyItemRoleid =
+  | "Admin"
+  | "Audit"
+  | "NoAccess"
+  | "DatastoreAdmin"
+  | "DatastoreReader"
+  | "DatastoreBackup"
+  | "DatastorePowerUser"
+  | "DatastoreAudit"
+  | "RemoteAudit"
+  | "RemoteAdmin"
+  | "RemoteSyncOperator"
+  | "RemoteSyncPushOperator"
+  | "RemoteDatastorePowerUser"
+  | "RemoteDatastoreAdmin"
+  | "TapeAudit"
+  | "TapeAdmin"
+  | "TapeOperator"
+  | "TapeReader";
+export const ListAccessAclResponseBodyItemRoleid = S.String;
+
+export type ListAccessAclResponseBodyItemUgidType = "user" | "group";
+export const ListAccessAclResponseBodyItemUgidType = S.String;
+
+export interface ListAccessAclResponseBodyItem {
+  path: string;
+  propagate: unknown;
+  roleid: ListAccessAclResponseBodyItemRoleid;
+  ugid: string;
+  ugid_type: ListAccessAclResponseBodyItemUgidType;
+}
+export const ListAccessAclResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String,
+    propagate: S.Unknown,
+    roleid: ListAccessAclResponseBodyItemRoleid,
+    ugid: S.String,
+    ugid_type: ListAccessAclResponseBodyItemUgidType,
+  }),
+).annotate({
+  identifier: "ListAccessAclResponseBodyItem",
+}) as any as S.Schema<ListAccessAclResponseBodyItem>;
+
+export type ListAccessAclResponseBodyList =
+  Array<ListAccessAclResponseBodyItem>;
+export const ListAccessAclResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessAclResponseBodyItem,
+) as any as S.Schema<ListAccessAclResponseBodyList>;
+
+export type ListAccessAclResponse = ListAccessAclResponseBodyList;
+export const ListAccessAclResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessAclResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessAclResponse",
+}) as any as S.Schema<ListAccessAclResponse>;
+
+export interface ListAccessDomainsRequest {}
+export const ListAccessDomainsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/domains", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessDomainsRequest",
+}) as any as S.Schema<ListAccessDomainsRequest>;
+
+export type ListAccessDomainsResponseBodyItemType =
+  | "pam"
+  | "pbs"
+  | "openid"
+  | "ldap"
+  | "ad";
+export const ListAccessDomainsResponseBodyItemType = S.String;
+
+export interface ListAccessDomainsResponseBodyItem {
+  comment?: string;
+  default?: unknown;
+  realm: string;
+  type: ListAccessDomainsResponseBodyItemType;
+}
+export const ListAccessDomainsResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    default: S.optional(S.Unknown),
+    realm: S.String,
+    type: ListAccessDomainsResponseBodyItemType,
+  }),
+).annotate({
+  identifier: "ListAccessDomainsResponseBodyItem",
+}) as any as S.Schema<ListAccessDomainsResponseBodyItem>;
+
+export type ListAccessDomainsResponseBodyList =
+  Array<ListAccessDomainsResponseBodyItem>;
+export const ListAccessDomainsResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessDomainsResponseBodyItem,
+) as any as S.Schema<ListAccessDomainsResponseBodyList>;
+
+export type ListAccessDomainsResponse = ListAccessDomainsResponseBodyList;
+export const ListAccessDomainsResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessDomainsResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessDomainsResponse",
+}) as any as S.Schema<ListAccessDomainsResponse>;
+
+export interface ListAccessRolesRequest {}
+export const ListAccessRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access/roles", code: 200 })),
+).annotate({
+  identifier: "ListAccessRolesRequest",
+}) as any as S.Schema<ListAccessRolesRequest>;
+
+export type ListAccessRolesResponseBodyItemPrivsList = Array<string>;
+export const ListAccessRolesResponseBodyItemPrivsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ListAccessRolesResponseBodyItemPrivsList>;
+
+export type ListAccessRolesResponseBodyItemRoleid =
+  | "Admin"
+  | "Audit"
+  | "NoAccess"
+  | "DatastoreAdmin"
+  | "DatastoreReader"
+  | "DatastoreBackup"
+  | "DatastorePowerUser"
+  | "DatastoreAudit"
+  | "RemoteAudit"
+  | "RemoteAdmin"
+  | "RemoteSyncOperator"
+  | "RemoteSyncPushOperator"
+  | "RemoteDatastorePowerUser"
+  | "RemoteDatastoreAdmin"
+  | "TapeAudit"
+  | "TapeAdmin"
+  | "TapeOperator"
+  | "TapeReader";
+export const ListAccessRolesResponseBodyItemRoleid = S.String;
+
+export interface ListAccessRolesResponseBodyItem {
+  comment?: string;
+  privs: ListAccessRolesResponseBodyItemPrivsList;
+  roleid: ListAccessRolesResponseBodyItemRoleid;
+}
+export const ListAccessRolesResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    privs: ListAccessRolesResponseBodyItemPrivsList,
+    roleid: ListAccessRolesResponseBodyItemRoleid,
+  }),
+).annotate({
+  identifier: "ListAccessRolesResponseBodyItem",
+}) as any as S.Schema<ListAccessRolesResponseBodyItem>;
+
+export type ListAccessRolesResponseBodyList =
+  Array<ListAccessRolesResponseBodyItem>;
+export const ListAccessRolesResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessRolesResponseBodyItem,
+) as any as S.Schema<ListAccessRolesResponseBodyList>;
+
+export type ListAccessRolesResponse = ListAccessRolesResponseBodyList;
+export const ListAccessRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessRolesResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessRolesResponse",
+}) as any as S.Schema<ListAccessRolesResponse>;
+
+export interface ListAccessTfaRequest {}
+export const ListAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access/tfa", code: 200 })),
+).annotate({
+  identifier: "ListAccessTfaRequest",
+}) as any as S.Schema<ListAccessTfaRequest>;
+
+export type ListAccessTfaResponseBodyItemEntriesItemType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const ListAccessTfaResponseBodyItemEntriesItemType = S.String;
+
+export interface ListAccessTfaResponseBodyItemEntriesItem {
+  created: number;
+  description: string;
+  enable: unknown;
+  id: string;
+  type: ListAccessTfaResponseBodyItemEntriesItemType;
+}
+export const ListAccessTfaResponseBodyItemEntriesItem = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      created: S.Number,
+      description: S.String,
+      enable: S.Unknown,
+      id: S.String,
+      type: ListAccessTfaResponseBodyItemEntriesItemType,
+    }),
+).annotate({
+  identifier: "ListAccessTfaResponseBodyItemEntriesItem",
+}) as any as S.Schema<ListAccessTfaResponseBodyItemEntriesItem>;
+
+export type ListAccessTfaResponseBodyItemEntriesList =
+  Array<ListAccessTfaResponseBodyItemEntriesItem>;
+export const ListAccessTfaResponseBodyItemEntriesList = /*@__PURE__*/ S.Array(
+  ListAccessTfaResponseBodyItemEntriesItem,
+) as any as S.Schema<ListAccessTfaResponseBodyItemEntriesList>;
+
+export interface ListAccessTfaResponseBodyItem {
+  entries: ListAccessTfaResponseBodyItemEntriesList;
+  tfa_locked_until?: number;
+  totp_locked?: unknown;
+  userid: string;
+}
+export const ListAccessTfaResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    entries: ListAccessTfaResponseBodyItemEntriesList,
+    tfa_locked_until: S.optional(S.Number.pipe(T.Body("tfa-locked-until"))),
+    totp_locked: S.optional(S.Unknown.pipe(T.Body("totp-locked"))),
+    userid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessTfaResponseBodyItem",
+}) as any as S.Schema<ListAccessTfaResponseBodyItem>;
+
+export type ListAccessTfaResponseBodyList =
+  Array<ListAccessTfaResponseBodyItem>;
+export const ListAccessTfaResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessTfaResponseBodyItem,
+) as any as S.Schema<ListAccessTfaResponseBodyList>;
+
+export type ListAccessTfaResponse = ListAccessTfaResponseBodyList;
+export const ListAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessTfaResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessTfaResponse",
+}) as any as S.Schema<ListAccessTfaResponse>;
+
+export interface ListAccessUsersRequest {
+  /** Include user's API tokens in returned list. */
+  include_tokens?: string;
+}
+export const ListAccessUsersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    include_tokens: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/access/users", code: 200 })),
+).annotate({
+  identifier: "ListAccessUsersRequest",
+}) as any as S.Schema<ListAccessUsersRequest>;
+
+export interface ListAccessUsersResponseBodyItemTokensItem {
+  comment?: string;
+  enable?: unknown;
+  expire?: number;
+  tokenid: string;
+}
+export const ListAccessUsersResponseBodyItemTokensItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      comment: S.optional(S.String),
+      enable: S.optional(S.Unknown),
+      expire: S.optional(S.Number),
+      tokenid: S.String,
+    }),
+  ).annotate({
+    identifier: "ListAccessUsersResponseBodyItemTokensItem",
+  }) as any as S.Schema<ListAccessUsersResponseBodyItemTokensItem>;
+
+export type ListAccessUsersResponseBodyItemTokensList =
+  Array<ListAccessUsersResponseBodyItemTokensItem>;
+export const ListAccessUsersResponseBodyItemTokensList = /*@__PURE__*/ S.Array(
+  ListAccessUsersResponseBodyItemTokensItem,
+) as any as S.Schema<ListAccessUsersResponseBodyItemTokensList>;
+
+export interface ListAccessUsersResponseBodyItem {
+  comment?: string;
+  email?: string;
+  enable?: unknown;
+  expire?: number;
+  firstname?: string;
+  lastname?: string;
+  tfa_locked_until?: number;
+  tokens?: ListAccessUsersResponseBodyItemTokensList;
+  totp_locked?: unknown;
+  userid: string;
+}
+export const ListAccessUsersResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    firstname: S.optional(S.String),
+    lastname: S.optional(S.String),
+    tfa_locked_until: S.optional(S.Number.pipe(T.Body("tfa-locked-until"))),
+    tokens: S.optional(ListAccessUsersResponseBodyItemTokensList),
+    totp_locked: S.optional(S.Unknown.pipe(T.Body("totp-locked"))),
+    userid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessUsersResponseBodyItem",
+}) as any as S.Schema<ListAccessUsersResponseBodyItem>;
+
+export type ListAccessUsersResponseBodyList =
+  Array<ListAccessUsersResponseBodyItem>;
+export const ListAccessUsersResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessUsersResponseBodyItem,
+) as any as S.Schema<ListAccessUsersResponseBodyList>;
+
+export type ListAccessUsersResponse = ListAccessUsersResponseBodyList;
+export const ListAccessUsersResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessUsersResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessUsersResponse",
+}) as any as S.Schema<ListAccessUsersResponse>;
+
+export interface ListAccessUserTokenRequest {
+  userid: string;
+}
+export const ListAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/users/{userid}/token", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessUserTokenRequest",
+}) as any as S.Schema<ListAccessUserTokenRequest>;
+
+export interface ListAccessUserTokenResponseBodyItem {
+  comment?: string;
+  enable?: unknown;
+  expire?: number;
+  token_name?: string;
+  tokenid: string;
+}
+export const ListAccessUserTokenResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    token_name: S.optional(S.String.pipe(T.Body("token-name"))),
+    tokenid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessUserTokenResponseBodyItem",
+}) as any as S.Schema<ListAccessUserTokenResponseBodyItem>;
+
+export type ListAccessUserTokenResponseBodyList =
+  Array<ListAccessUserTokenResponseBodyItem>;
+export const ListAccessUserTokenResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessUserTokenResponseBodyItem,
+) as any as S.Schema<ListAccessUserTokenResponseBodyList>;
+
+export type ListAccessUserTokenResponse = ListAccessUserTokenResponseBodyList;
+export const ListAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessUserTokenResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessUserTokenResponse",
+}) as any as S.Schema<ListAccessUserTokenResponse>;
+
+export interface LoginAccessOpenidRequest {
+  /** OpenId authorization code. */
+  code: string;
+  /** Whether the HttpOnly authentication flow should be used. */
+  http_only?: string;
+  /** Redirection Url. The client should set this to used server url. */
+  redirect_url: string;
+  /** OpenId state. */
+  state: string;
+}
+export const LoginAccessOpenidRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.String,
+    http_only: S.optional(S.String.pipe(T.Body("http-only"))),
+    redirect_url: S.String.pipe(T.Body("redirect-url")),
+    state: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/openid/login",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "LoginAccessOpenidRequest",
+}) as any as S.Schema<LoginAccessOpenidRequest>;
+
+export interface LoginAccessOpenidResponse {
+  CSRFPreventionToken: string;
+  ticket?: string;
+  ticket_info?: string;
+  username: string;
+}
+export const LoginAccessOpenidResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    CSRFPreventionToken: S.String,
+    ticket: S.optional(S.String),
+    ticket_info: S.optional(S.String.pipe(T.Body("ticket-info"))),
+    username: S.String,
+  }),
+).annotate({
+  identifier: "LoginAccessOpenidResponse",
+}) as any as S.Schema<LoginAccessOpenidResponse>;
+
+export type PutAccessAclRequestRole =
+  | "Admin"
+  | "Audit"
+  | "NoAccess"
+  | "DatastoreAdmin"
+  | "DatastoreReader"
+  | "DatastoreBackup"
+  | "DatastorePowerUser"
+  | "DatastoreAudit"
+  | "RemoteAudit"
+  | "RemoteAdmin"
+  | "RemoteSyncOperator"
+  | "RemoteSyncPushOperator"
+  | "RemoteDatastorePowerUser"
+  | "RemoteDatastoreAdmin"
+  | "TapeAudit"
+  | "TapeAdmin"
+  | "TapeOperator"
+  | "TapeReader";
+export const PutAccessAclRequestRole = S.String;
+
+export interface PutAccessAclRequest {
+  /** Authentication ID */
+  auth_id?: string;
+  /** Remove permissions (instead of adding it). */
+  delete?: string;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+  /** Group ID */
+  group?: string;
+  /** Access control path. */
+  path: string;
+  /** Allow to propagate (inherit) permissions. */
+  propagate?: string;
+  /** Enum representing roles via their [PRIVILEGES] combination. Since privileges are implemented as bitflags, each unique combination of privileges maps to a single, unique `u64` value that is used in this enum definition. */
+  role: PutAccessAclRequestRole | (string & {});
+}
+export const PutAccessAclRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    auth_id: S.optional(S.String.pipe(T.Body("auth-id"))),
+    delete: S.optional(S.String),
+    digest: S.optional(S.String),
+    group: S.optional(S.String),
+    path: S.String,
+    propagate: S.optional(S.String),
+    role: PutAccessAclRequestRole,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/acl",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessAclRequest",
+}) as any as S.Schema<PutAccessAclRequest>;
+
+export interface PutAccessAclResponse {}
+export const PutAccessAclResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessAclResponse",
+}) as any as S.Schema<PutAccessAclResponse>;
+
+export interface PutAccessPasswordRequest {
+  /** The current password for confirmation, unless logged in as root@pam */
+  confirmation_password?: string;
+  /** User Password. */
+  password: string;
+  /** User ID */
+  userid: string;
+}
+export const PutAccessPasswordRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    confirmation_password: S.optional(
+      S.String.pipe(T.Body("confirmation-password")),
+    ),
+    password: S.String,
+    userid: S.String,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/password",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessPasswordRequest",
+}) as any as S.Schema<PutAccessPasswordRequest>;
+
+export interface PutAccessPasswordResponse {}
+export const PutAccessPasswordResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessPasswordResponse",
+}) as any as S.Schema<PutAccessPasswordResponse>;
+
+export interface PutAccessTfaRequest {
+  userid: string;
+  id: string;
+  /** A description to distinguish multiple entries from one another */
+  description?: string;
+  /** Whether this entry should currently be enabled or disabled */
+  enable?: string;
+  /** Password. */
+  password?: string;
+}
+export const PutAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+    description: S.optional(S.String),
+    enable: S.optional(S.String),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/tfa/{userid}/{id}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessTfaRequest",
+}) as any as S.Schema<PutAccessTfaRequest>;
+
+export interface PutAccessTfaResponse {}
+export const PutAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessTfaResponse",
+}) as any as S.Schema<PutAccessTfaResponse>;
+
+export type PutAccessUserRequestDeleteItem =
+  | "comment"
+  | "firstname"
+  | "lastname"
+  | "email";
+export const PutAccessUserRequestDeleteItem = S.String;
+
+export type PutAccessUserRequestDeleteList = Array<
+  PutAccessUserRequestDeleteItem | (string & {})
+>;
+export const PutAccessUserRequestDeleteList = /*@__PURE__*/ S.Array(
+  PutAccessUserRequestDeleteItem,
+) as any as S.Schema<PutAccessUserRequestDeleteList>;
+
+export interface PutAccessUserRequest {
+  userid: string;
+  /** Comment. */
+  comment?: string;
+  /** List of properties to delete. */
+  delete?: PutAccessUserRequestDeleteList;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+  /** E-Mail Address. */
+  email?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account. */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  /** First name. */
+  firstname?: string;
+  /** Last name. */
+  lastname?: string;
+  /** This parameter is ignored, please use 'PUT /access/password' to change a user's password */
+  password?: string;
+}
+export const PutAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+    delete: S.optional(PutAccessUserRequestDeleteList),
+    digest: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+    firstname: S.optional(S.String),
+    lastname: S.optional(S.String),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserRequest",
+}) as any as S.Schema<PutAccessUserRequest>;
+
+export interface PutAccessUserResponse {}
+export const PutAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessUserResponse",
+}) as any as S.Schema<PutAccessUserResponse>;
+
+export type PutAccessUserTokenRequestDeleteItem = "comment";
+export const PutAccessUserTokenRequestDeleteItem = S.String;
+
+export type PutAccessUserTokenRequestDeleteList = Array<
+  PutAccessUserTokenRequestDeleteItem | (string & {})
+>;
+export const PutAccessUserTokenRequestDeleteList = /*@__PURE__*/ S.Array(
+  PutAccessUserTokenRequestDeleteItem,
+) as any as S.Schema<PutAccessUserTokenRequestDeleteList>;
+
+export interface PutAccessUserTokenRequest {
+  userid: string;
+  token_name: string;
+  /** Comment. */
+  comment?: string;
+  /** List of properties to delete. */
+  delete?: PutAccessUserTokenRequestDeleteList;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account. */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  /** Regenerate token secret while keeping permissions. */
+  regenerate?: string;
+}
+export const PutAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    token_name: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+    delete: S.optional(PutAccessUserTokenRequestDeleteList),
+    digest: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+    regenerate: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}/token/{token-name}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserTokenRequest",
+}) as any as S.Schema<PutAccessUserTokenRequest>;
+
+export interface PutAccessUserTokenResponse {
+  secret?: string;
+}
+export const PutAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    secret: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "PutAccessUserTokenResponse",
+}) as any as S.Schema<PutAccessUserTokenResponse>;
+
+export interface PutAccessUserUnlockTfaRequest {
+  userid: string;
+}
+export const PutAccessUserUnlockTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}/unlock-tfa",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserUnlockTfaRequest",
+}) as any as S.Schema<PutAccessUserUnlockTfaRequest>;
+
+export type PutAccessUserUnlockTfaResponse = unknown;
+export const PutAccessUserUnlockTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "PutAccessUserUnlockTfaResponse",
+}) as any as S.Schema<PutAccessUserUnlockTfaResponse>;
+
+export interface SyncAccessDomainRequest {
+  realm: string;
+  /** If set, do not create/delete anything */
+  dry_run?: string;
+  /** Enable newly synced users immediately */
+  enable_new?: string;
+  /** A semicolon-separated list of things to remove when they or the user vanishes during user synchronization. The following values are possible: ``entry`` removes the user when not returned from the sync; ``properties`` removes any properties on existing user that do not appear in the source. ``acl`` removes ACLs when the user is not returned from the sync. */
+  remove_vanished?: string;
+}
+export const SyncAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String.pipe(T.Label()),
+    dry_run: S.optional(S.String.pipe(T.Body("dry-run"))),
+    enable_new: S.optional(S.String.pipe(T.Body("enable-new"))),
+    remove_vanished: S.optional(S.String.pipe(T.Body("remove-vanished"))),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/domains/{realm}/sync",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "SyncAccessDomainRequest",
+}) as any as S.Schema<SyncAccessDomainRequest>;
+
+export type SyncAccessDomainResponse = string;
+export const SyncAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.String.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "SyncAccessDomainResponse",
+}) as any as S.Schema<SyncAccessDomainResponse>;
+
+export type UpdateAccessTfaRequestType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const UpdateAccessTfaRequestType = S.String;
+
+export interface UpdateAccessTfaRequest {
+  userid: string;
+  /** When responding to a u2f challenge: the original challenge string */
+  challenge?: string;
+  /** A description to distinguish multiple entries from one another */
+  description?: string;
+  /** Password. */
+  password?: string;
+  /** A totp URI. */
+  totp?: string;
+  /** A TFA entry type. */
+  type: UpdateAccessTfaRequestType | (string & {});
+  /** The current value for the provided totp URI, or a Webauthn/U2F challenge response */
+  value?: string;
+}
+export const UpdateAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    challenge: S.optional(S.String),
+    description: S.optional(S.String),
+    password: S.optional(S.String),
+    totp: S.optional(S.String),
+    type: UpdateAccessTfaRequestType,
+    value: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/tfa/{userid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateAccessTfaRequest",
+}) as any as S.Schema<UpdateAccessTfaRequest>;
+
+export type UpdateAccessTfaResponseRecoveryList = Array<number>;
+export const UpdateAccessTfaResponseRecoveryList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<UpdateAccessTfaResponseRecoveryList>;
+
+export interface UpdateAccessTfaResponse {
+  challenge?: string;
+  id?: string;
+  recovery: UpdateAccessTfaResponseRecoveryList;
+}
+export const UpdateAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    challenge: S.optional(S.String),
+    id: S.optional(S.String),
+    recovery: UpdateAccessTfaResponseRecoveryList,
+  }),
+).annotate({
+  identifier: "UpdateAccessTfaResponse",
+}) as any as S.Schema<UpdateAccessTfaResponse>;
+
+export interface UpdateAccessUserTokenRequest {
+  userid: string;
+  token_name: string;
+  /** Comment. */
+  comment?: string;
+  /** Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account. */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+}
+export const UpdateAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    token_name: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+    digest: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/users/{userid}/token/{token-name}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateAccessUserTokenRequest",
+}) as any as S.Schema<UpdateAccessUserTokenRequest>;
+
+export interface UpdateAccessUserTokenResponse {
+  tokenid: string;
+  value: string;
+}
+export const UpdateAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokenid: S.String,
+    value: S.String,
+  }),
+).annotate({
+  identifier: "UpdateAccessUserTokenResponse",
+}) as any as S.Schema<UpdateAccessUserTokenResponse>;
+
+export type CreateAccessOpenidAuthUrlError = ProxmoxBackupOpError;
+/** Create OpenID Redirect Session */
+export const createAccessOpenidAuthUrl: API.OperationMethod<
+  CreateAccessOpenidAuthUrlRequest,
+  CreateAccessOpenidAuthUrlResponse,
+  CreateAccessOpenidAuthUrlError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessOpenidAuthUrlRequest,
+  output: CreateAccessOpenidAuthUrlResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessTicketError = ProxmoxBackupOpError;
+/** Either create a new HttpOnly ticket or a regular ticket. */
+export const createAccessTicket: API.OperationMethod<
+  CreateAccessTicketRequest,
+  CreateAccessTicketResponse,
+  CreateAccessTicketError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessTicketRequest,
+  output: CreateAccessTicketResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessUserError = ProxmoxBackupOpError;
+/** Create new user. */
+export const createAccessUser: API.OperationMethod<
+  CreateAccessUserRequest,
+  CreateAccessUserResponse,
+  CreateAccessUserError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessUserRequest,
+  output: CreateAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessVncticketError = ProxmoxBackupOpError;
+/** Verify that a VNC ticket is valid for a given Authid, path and privilege(s). */
+export const createAccessVncticket: API.OperationMethod<
+  CreateAccessVncticketRequest,
+  CreateAccessVncticketResponse,
+  CreateAccessVncticketError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessVncticketRequest,
+  output: CreateAccessVncticketResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessTfaError = ProxmoxBackupOpError;
+/** Delete a single TFA entry. */
+export const deleteAccessTfa: API.OperationMethod<
+  DeleteAccessTfaRequest,
+  DeleteAccessTfaResponse,
+  DeleteAccessTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessTfaRequest,
+  output: DeleteAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessTicketError = ProxmoxBackupOpError;
+export const deleteAccessTicket: API.OperationMethod<
+  DeleteAccessTicketRequest,
+  DeleteAccessTicketResponse,
+  DeleteAccessTicketError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessTicketRequest,
+  output: DeleteAccessTicketResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessUserError = ProxmoxBackupOpError;
+/** Remove a user from the configuration file. */
+export const deleteAccessUser: API.OperationMethod<
+  DeleteAccessUserRequest,
+  DeleteAccessUserResponse,
+  DeleteAccessUserError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessUserRequest,
+  output: DeleteAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessUserTokenError = ProxmoxBackupOpError;
+/** Delete a user's API token */
+export const deleteAccessUserToken: API.OperationMethod<
+  DeleteAccessUserTokenRequest,
+  DeleteAccessUserTokenResponse,
+  DeleteAccessUserTokenError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessUserTokenRequest,
+  output: DeleteAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessError = ProxmoxBackupOpError;
+/** Directory index. */
+export const getAccess: API.OperationMethod<
+  GetAccessRequest,
+  GetAccessResponse,
+  GetAccessError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessRequest,
+  output: GetAccessResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessOpenidError = ProxmoxBackupOpError;
+/** Directory index. */
+export const getAccessOpenid: API.OperationMethod<
+  GetAccessOpenidRequest,
+  GetAccessOpenidResponse,
+  GetAccessOpenidError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessOpenidRequest,
+  output: GetAccessOpenidResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessPermissionsError = ProxmoxBackupOpError;
+/** List permissions of given or currently authenticated user / API token. Optionally limited to specific path. */
+export const getAccessPermissions: API.OperationMethod<
+  GetAccessPermissionsRequest,
+  GetAccessPermissionsResponse,
+  GetAccessPermissionsError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessPermissionsRequest,
+  output: GetAccessPermissionsResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessTfaError = ProxmoxBackupOpError;
+/** Add a TOTP secret to the user. */
+export const getAccessTfa: API.OperationMethod<
+  GetAccessTfaRequest,
+  GetAccessTfaResponse,
+  GetAccessTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessTfaRequest,
+  output: GetAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessTfa2Error = ProxmoxBackupOpError;
+/** Get a single TFA entry. */
+export const getAccessTfa2: API.OperationMethod<
+  GetAccessTfa2Request,
+  GetAccessTfa2Response,
+  GetAccessTfa2Error,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessTfa2Request,
+  output: GetAccessTfa2Response,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessUserError = ProxmoxBackupOpError;
+/** Read user configuration data. */
+export const getAccessUser: API.OperationMethod<
+  GetAccessUserRequest,
+  GetAccessUserResponse,
+  GetAccessUserError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessUserRequest,
+  output: GetAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessUserTokenError = ProxmoxBackupOpError;
+/** Read user's API token metadata */
+export const getAccessUserToken: API.OperationMethod<
+  GetAccessUserTokenRequest,
+  GetAccessUserTokenResponse,
+  GetAccessUserTokenError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessUserTokenRequest,
+  output: GetAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessAclError = ProxmoxBackupOpError;
+/** Read Access Control List (ACLs). */
+export const listAccessAcl: API.OperationMethod<
+  ListAccessAclRequest,
+  ListAccessAclResponse,
+  ListAccessAclError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessAclRequest,
+  output: ListAccessAclResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessDomainsError = ProxmoxBackupOpError;
+/** Authentication domain/realm index. */
+export const listAccessDomains: API.OperationMethod<
+  ListAccessDomainsRequest,
+  ListAccessDomainsResponse,
+  ListAccessDomainsError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessDomainsRequest,
+  output: ListAccessDomainsResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessRolesError = ProxmoxBackupOpError;
+/** Role list */
+export const listAccessRoles: API.OperationMethod<
+  ListAccessRolesRequest,
+  ListAccessRolesResponse,
+  ListAccessRolesError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessRolesRequest,
+  output: ListAccessRolesResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessTfaError = ProxmoxBackupOpError;
+/** List user TFA configuration. */
+export const listAccessTfa: API.OperationMethod<
+  ListAccessTfaRequest,
+  ListAccessTfaResponse,
+  ListAccessTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessTfaRequest,
+  output: ListAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessUsersError = ProxmoxBackupOpError;
+/** List users */
+export const listAccessUsers: API.OperationMethod<
+  ListAccessUsersRequest,
+  ListAccessUsersResponse,
+  ListAccessUsersError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessUsersRequest,
+  output: ListAccessUsersResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessUserTokenError = ProxmoxBackupOpError;
+/** List user's API tokens */
+export const listAccessUserToken: API.OperationMethod<
+  ListAccessUserTokenRequest,
+  ListAccessUserTokenResponse,
+  ListAccessUserTokenError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessUserTokenRequest,
+  output: ListAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginAccessOpenidError = ProxmoxBackupOpError;
+/** Get a new ticket as an HttpOnly cookie. Supports tickets via cookies. */
+export const loginAccessOpenid: API.OperationMethod<
+  LoginAccessOpenidRequest,
+  LoginAccessOpenidResponse,
+  LoginAccessOpenidError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginAccessOpenidRequest,
+  output: LoginAccessOpenidResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessAclError = ProxmoxBackupOpError;
+/** Update Access Control List (ACLs). */
+export const putAccessAcl: API.OperationMethod<
+  PutAccessAclRequest,
+  PutAccessAclResponse,
+  PutAccessAclError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessAclRequest,
+  output: PutAccessAclResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessPasswordError = ProxmoxBackupOpError;
+/** Change user password Each user is allowed to change his own password. Superuser can change all passwords. */
+export const putAccessPassword: API.OperationMethod<
+  PutAccessPasswordRequest,
+  PutAccessPasswordResponse,
+  PutAccessPasswordError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessPasswordRequest,
+  output: PutAccessPasswordResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessTfaError = ProxmoxBackupOpError;
+/** Update user's TFA entry description. */
+export const putAccessTfa: API.OperationMethod<
+  PutAccessTfaRequest,
+  PutAccessTfaResponse,
+  PutAccessTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessTfaRequest,
+  output: PutAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserError = ProxmoxBackupOpError;
+/** Update user configuration. To change a user's password use the 'PUT /access/password' endpoint. */
+export const putAccessUser: API.OperationMethod<
+  PutAccessUserRequest,
+  PutAccessUserResponse,
+  PutAccessUserError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserRequest,
+  output: PutAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserTokenError = ProxmoxBackupOpError;
+/** Update user's API token metadata */
+export const putAccessUserToken: API.OperationMethod<
+  PutAccessUserTokenRequest,
+  PutAccessUserTokenResponse,
+  PutAccessUserTokenError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserTokenRequest,
+  output: PutAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserUnlockTfaError = ProxmoxBackupOpError;
+/** Unlock a user's TFA authentication. */
+export const putAccessUserUnlockTfa: API.OperationMethod<
+  PutAccessUserUnlockTfaRequest,
+  PutAccessUserUnlockTfaResponse,
+  PutAccessUserUnlockTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserUnlockTfaRequest,
+  output: PutAccessUserUnlockTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SyncAccessDomainError = ProxmoxBackupOpError;
+/** Synchronize users of a given realm */
+export const syncAccessDomain: API.OperationMethod<
+  SyncAccessDomainRequest,
+  SyncAccessDomainResponse,
+  SyncAccessDomainError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SyncAccessDomainRequest,
+  output: SyncAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateAccessTfaError = ProxmoxBackupOpError;
+/** Add a TFA entry to the user. */
+export const updateAccessTfa: API.OperationMethod<
+  UpdateAccessTfaRequest,
+  UpdateAccessTfaResponse,
+  UpdateAccessTfaError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateAccessTfaRequest,
+  output: UpdateAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateAccessUserTokenError = ProxmoxBackupOpError;
+/** Generate a new API token with given metadata */
+export const updateAccessUserToken: API.OperationMethod<
+  UpdateAccessUserTokenRequest,
+  UpdateAccessUserTokenResponse,
+  UpdateAccessUserTokenError,
+  ProxmoxBackupOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateAccessUserTokenRequest,
+  output: UpdateAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxBackupProtocol,
+  retry: Retry.Retry,
+}));