@homeflare/distilled-proxmox 0.2.0

package/src/services/access.ts

@@ -0,0 +1,2722 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (apidata.js, via scripts/apidoc.ts — see its header). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  ProxmoxProtocol,
+  type ProxmoxOpError,
+  type ProxmoxOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { ProxmoxOpError, ProxmoxOpContext };
+
+export type CreateAccessDomainRequestMode = "ldap" | "ldaps" | "ldap+starttls";
+export const CreateAccessDomainRequestMode = S.String;
+
+export type CreateAccessDomainRequestSslversion =
+  | "tlsv1"
+  | "tlsv1_1"
+  | "tlsv1_2"
+  | "tlsv1_3";
+export const CreateAccessDomainRequestSslversion = S.String;
+
+export type CreateAccessDomainRequestType =
+  | "ad"
+  | "ldap"
+  | "openid"
+  | "pam"
+  | "pve";
+export const CreateAccessDomainRequestType = S.String;
+
+export interface CreateAccessDomainRequest {
+  /** Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request. */
+  acr_values?: string;
+  /** A list of audiences that the OpenID Issuer may include that are accepted in addition to 'client-id'. */
+  audiences?: string;
+  /** Automatically create users if they do not exist. */
+  autocreate?: string;
+  /** LDAP base domain name */
+  base_dn?: string;
+  /** LDAP bind domain name */
+  bind_dn?: string;
+  /** Path to the CA certificate store */
+  capath?: string;
+  /** username is case-sensitive */
+  case_sensitive?: string;
+  /** Path to the client certificate */
+  cert?: string;
+  /** Path to the client certificate key */
+  certkey?: string;
+  /** Check bind connection to the server. */
+  check_connection?: string;
+  /** OpenID Client ID */
+  client_id?: string;
+  /** OpenID Client Key */
+  client_key?: string;
+  /** Description. */
+  comment?: string;
+  /** Use this as default realm */
+  default?: string;
+  /** AD domain name */
+  domain?: string;
+  /** LDAP filter for user sync. */
+  filter?: string;
+  /** The objectclasses for groups. */
+  group_classes?: string;
+  /** LDAP base domain name for group sync. If not set, the base_dn will be used. */
+  group_dn?: string;
+  /** LDAP filter for group sync. */
+  group_filter?: string;
+  /** LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name. */
+  group_name_attr?: string;
+  /** Automatically create groups if they do not exist. */
+  groups_autocreate?: string;
+  /** OpenID claim used to retrieve groups with. */
+  groups_claim?: string;
+  /** All groups will be overwritten for the user on login. */
+  groups_overwrite?: string;
+  /** OpenID Issuer Url */
+  issuer_url?: string;
+  /** LDAP protocol mode. */
+  mode?: CreateAccessDomainRequestMode | (string & {});
+  /** LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'. */
+  password?: string;
+  /** Server port. */
+  port?: string;
+  /** Specifies whether the Authorization Server prompts the End-User for reauthentication and consent. */
+  prompt?: string;
+  /** Enables querying the userinfo endpoint for claims values. */
+  query_userinfo?: string;
+  /** Authentication domain ID */
+  realm: string;
+  /** Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'. */
+  scopes?: string;
+  /** Use secure LDAPS protocol. DEPRECATED: use 'mode' instead. */
+  secure?: string;
+  /** Server IP address (or DNS name) */
+  server1?: string;
+  /** Fallback Server IP address (or DNS name) */
+  server2?: string;
+  /** LDAPS TLS/SSL version. It's not recommended to use version older than 1.2! */
+  sslversion?: CreateAccessDomainRequestSslversion | (string & {});
+  /** The default options for behavior of synchronizations. */
+  sync_defaults_options?: string;
+  /** Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write 'email=mail'. By default, each PVE user field is represented by an LDAP attribute of the same name. */
+  sync_attributes?: string;
+  /** Use Two-factor authentication. */
+  tfa?: string;
+  /** Realm type. */
+  type: CreateAccessDomainRequestType | (string & {});
+  /** LDAP user attribute name */
+  user_attr?: string;
+  /** The objectclasses for users. */
+  user_classes?: string;
+  /** OpenID claim used to generate the unique username. */
+  username_claim?: string;
+  /** Verify the server's SSL certificate */
+  verify?: string;
+}
+export const CreateAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    acr_values: S.optional(S.String.pipe(T.Body("acr-values"))),
+    audiences: S.optional(S.String),
+    autocreate: S.optional(S.String),
+    base_dn: S.optional(S.String),
+    bind_dn: S.optional(S.String),
+    capath: S.optional(S.String),
+    case_sensitive: S.optional(S.String.pipe(T.Body("case-sensitive"))),
+    cert: S.optional(S.String),
+    certkey: S.optional(S.String),
+    check_connection: S.optional(S.String.pipe(T.Body("check-connection"))),
+    client_id: S.optional(S.String.pipe(T.Body("client-id"))),
+    client_key: S.optional(S.String.pipe(T.Body("client-key"))),
+    comment: S.optional(S.String),
+    default: S.optional(S.String),
+    domain: S.optional(S.String),
+    filter: S.optional(S.String),
+    group_classes: S.optional(S.String),
+    group_dn: S.optional(S.String),
+    group_filter: S.optional(S.String),
+    group_name_attr: S.optional(S.String),
+    groups_autocreate: S.optional(S.String.pipe(T.Body("groups-autocreate"))),
+    groups_claim: S.optional(S.String.pipe(T.Body("groups-claim"))),
+    groups_overwrite: S.optional(S.String.pipe(T.Body("groups-overwrite"))),
+    issuer_url: S.optional(S.String.pipe(T.Body("issuer-url"))),
+    mode: S.optional(CreateAccessDomainRequestMode),
+    password: S.optional(S.String),
+    port: S.optional(S.String),
+    prompt: S.optional(S.String),
+    query_userinfo: S.optional(S.String.pipe(T.Body("query-userinfo"))),
+    realm: S.String,
+    scopes: S.optional(S.String),
+    secure: S.optional(S.String),
+    server1: S.optional(S.String),
+    server2: S.optional(S.String),
+    sslversion: S.optional(CreateAccessDomainRequestSslversion),
+    sync_defaults_options: S.optional(
+      S.String.pipe(T.Body("sync-defaults-options")),
+    ),
+    sync_attributes: S.optional(S.String),
+    tfa: S.optional(S.String),
+    type: CreateAccessDomainRequestType,
+    user_attr: S.optional(S.String),
+    user_classes: S.optional(S.String),
+    username_claim: S.optional(S.String.pipe(T.Body("username-claim"))),
+    verify: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/domains",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessDomainRequest",
+}) as any as S.Schema<CreateAccessDomainRequest>;
+
+export interface CreateAccessDomainResponse {}
+export const CreateAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessDomainResponse",
+}) as any as S.Schema<CreateAccessDomainResponse>;
+
+export interface CreateAccessGroupRequest {
+  comment?: string;
+  groupid: string;
+}
+export const CreateAccessGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    groupid: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/groups",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessGroupRequest",
+}) as any as S.Schema<CreateAccessGroupRequest>;
+
+export interface CreateAccessGroupResponse {}
+export const CreateAccessGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessGroupResponse",
+}) as any as S.Schema<CreateAccessGroupResponse>;
+
+export interface CreateAccessOpenidAuthUrlRequest {
+  /** Authentication domain ID */
+  realm: string;
+  /** Redirection Url. The client should set this to the used server url (location.origin). */
+  redirect_url: string;
+}
+export const CreateAccessOpenidAuthUrlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String,
+    redirect_url: S.String.pipe(T.Body("redirect-url")),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/openid/auth-url",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessOpenidAuthUrlRequest",
+}) as any as S.Schema<CreateAccessOpenidAuthUrlRequest>;
+
+export type CreateAccessOpenidAuthUrlResponse = string;
+export const CreateAccessOpenidAuthUrlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.String.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "CreateAccessOpenidAuthUrlResponse",
+}) as any as S.Schema<CreateAccessOpenidAuthUrlResponse>;
+
+export interface CreateAccessRoleRequest {
+  privs?: string;
+  roleid: string;
+}
+export const CreateAccessRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    privs: S.optional(S.String),
+    roleid: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/roles",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessRoleRequest",
+}) as any as S.Schema<CreateAccessRoleRequest>;
+
+export interface CreateAccessRoleResponse {}
+export const CreateAccessRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessRoleResponse",
+}) as any as S.Schema<CreateAccessRoleResponse>;
+
+export interface CreateAccessTicketRequest {
+  /** This parameter is now ignored and assumed to be 1. */
+  new_format?: string;
+  /** One-time password for Two-factor authentication. */
+  otp?: string;
+  /** The secret password. This can also be a valid ticket. */
+  password: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path' */
+  path?: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path' */
+  privs?: string;
+  /** You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<realm>. */
+  realm?: string;
+  /** The signed TFA challenge string the user wants to respond to. */
+  tfa_challenge?: string;
+  /** User name */
+  username: string;
+}
+export const CreateAccessTicketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    new_format: S.optional(S.String.pipe(T.Body("new-format"))),
+    otp: S.optional(S.String),
+    password: S.String,
+    path: S.optional(S.String),
+    privs: S.optional(S.String),
+    realm: S.optional(S.String),
+    tfa_challenge: S.optional(S.String.pipe(T.Body("tfa-challenge"))),
+    username: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/ticket",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessTicketRequest",
+}) as any as S.Schema<CreateAccessTicketRequest>;
+
+export interface CreateAccessTicketResponse {
+  CSRFPreventionToken?: string;
+  clustername?: string;
+  ticket?: string;
+  username: string;
+}
+export const CreateAccessTicketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    CSRFPreventionToken: S.optional(S.String),
+    clustername: S.optional(S.String),
+    ticket: S.optional(S.String),
+    username: S.String,
+  }),
+).annotate({
+  identifier: "CreateAccessTicketResponse",
+}) as any as S.Schema<CreateAccessTicketResponse>;
+
+export interface CreateAccessUserRequest {
+  comment?: string;
+  email?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  firstname?: string;
+  groups?: string;
+  /** Keys for two factor auth (yubico). */
+  keys?: string;
+  lastname?: string;
+  /** Initial password. */
+  password?: string;
+  /** Full User ID, in the `name@realm` format. */
+  userid: string;
+}
+export const CreateAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+    firstname: S.optional(S.String),
+    groups: S.optional(S.String),
+    keys: S.optional(S.String),
+    lastname: S.optional(S.String),
+    password: S.optional(S.String),
+    userid: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/users",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessUserRequest",
+}) as any as S.Schema<CreateAccessUserRequest>;
+
+export interface CreateAccessUserResponse {}
+export const CreateAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessUserResponse",
+}) as any as S.Schema<CreateAccessUserResponse>;
+
+export interface CreateAccessVncticketRequest {
+  /** UserId or token */
+  authid: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path' */
+  path: string;
+  /** Verify that the ticket is valid for this port. */
+  port?: string;
+  /** Verify ticket, and check if user have access 'privs' on 'path' */
+  privs: string;
+  /** The VNC ticket. */
+  vncticket: string;
+}
+export const CreateAccessVncticketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    authid: S.String,
+    path: S.String,
+    port: S.optional(S.String),
+    privs: S.String,
+    vncticket: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/vncticket",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "CreateAccessVncticketRequest",
+}) as any as S.Schema<CreateAccessVncticketRequest>;
+
+export interface CreateAccessVncticketResponse {}
+export const CreateAccessVncticketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateAccessVncticketResponse",
+}) as any as S.Schema<CreateAccessVncticketResponse>;
+
+export interface DeleteAccessDomainRequest {
+  realm: string;
+}
+export const DeleteAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/access/domains/{realm}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAccessDomainRequest",
+}) as any as S.Schema<DeleteAccessDomainRequest>;
+
+export interface DeleteAccessDomainResponse {}
+export const DeleteAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessDomainResponse",
+}) as any as S.Schema<DeleteAccessDomainResponse>;
+
+export interface DeleteAccessGroupRequest {
+  groupid: string;
+}
+export const DeleteAccessGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    groupid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/access/groups/{groupid}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAccessGroupRequest",
+}) as any as S.Schema<DeleteAccessGroupRequest>;
+
+export interface DeleteAccessGroupResponse {}
+export const DeleteAccessGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessGroupResponse",
+}) as any as S.Schema<DeleteAccessGroupResponse>;
+
+export interface DeleteAccessRoleRequest {
+  roleid: string;
+}
+export const DeleteAccessRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    roleid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/access/roles/{roleid}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAccessRoleRequest",
+}) as any as S.Schema<DeleteAccessRoleRequest>;
+
+export interface DeleteAccessRoleResponse {}
+export const DeleteAccessRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessRoleResponse",
+}) as any as S.Schema<DeleteAccessRoleResponse>;
+
+export interface DeleteAccessTfaRequest {
+  userid: string;
+  id: string;
+  /** The current password of the user performing the change. */
+  password?: string;
+}
+export const DeleteAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/access/tfa/{userid}/{id}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteAccessTfaRequest",
+}) as any as S.Schema<DeleteAccessTfaRequest>;
+
+export interface DeleteAccessTfaResponse {}
+export const DeleteAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessTfaResponse",
+}) as any as S.Schema<DeleteAccessTfaResponse>;
+
+export interface DeleteAccessUserRequest {
+  userid: string;
+}
+export const DeleteAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/access/users/{userid}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAccessUserRequest",
+}) as any as S.Schema<DeleteAccessUserRequest>;
+
+export interface DeleteAccessUserResponse {}
+export const DeleteAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessUserResponse",
+}) as any as S.Schema<DeleteAccessUserResponse>;
+
+export interface DeleteAccessUserTokenRequest {
+  userid: string;
+  tokenid: string;
+}
+export const DeleteAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    tokenid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/access/users/{userid}/token/{tokenid}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "DeleteAccessUserTokenRequest",
+}) as any as S.Schema<DeleteAccessUserTokenRequest>;
+
+export interface DeleteAccessUserTokenResponse {}
+export const DeleteAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteAccessUserTokenResponse",
+}) as any as S.Schema<DeleteAccessUserTokenResponse>;
+
+export interface GetAccessDomainRequest {
+  realm: string;
+}
+export const GetAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/domains/{realm}", code: 200 })),
+).annotate({
+  identifier: "GetAccessDomainRequest",
+}) as any as S.Schema<GetAccessDomainRequest>;
+
+export type GetAccessDomainResponse = unknown;
+export const GetAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "GetAccessDomainResponse",
+}) as any as S.Schema<GetAccessDomainResponse>;
+
+export interface GetAccessGroupRequest {
+  groupid: string;
+}
+export const GetAccessGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    groupid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/groups/{groupid}", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessGroupRequest",
+}) as any as S.Schema<GetAccessGroupRequest>;
+
+export type GetAccessGroupResponseMembersList = Array<string>;
+export const GetAccessGroupResponseMembersList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<GetAccessGroupResponseMembersList>;
+
+export interface GetAccessGroupResponse {
+  comment?: string;
+  members: GetAccessGroupResponseMembersList;
+}
+export const GetAccessGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    members: GetAccessGroupResponseMembersList,
+  }),
+).annotate({
+  identifier: "GetAccessGroupResponse",
+}) as any as S.Schema<GetAccessGroupResponse>;
+
+export interface GetAccessPermissionsRequest {
+  /** Only dump this specific path, not the whole tree. */
+  path?: string;
+  /** User ID or full API token ID */
+  userid?: string;
+}
+export const GetAccessPermissionsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.optional(S.String.pipe(T.Query())),
+    userid: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/access/permissions", code: 200 })),
+).annotate({
+  identifier: "GetAccessPermissionsRequest",
+}) as any as S.Schema<GetAccessPermissionsRequest>;
+
+export type GetAccessPermissionsResponse = unknown;
+export const GetAccessPermissionsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "GetAccessPermissionsResponse",
+}) as any as S.Schema<GetAccessPermissionsResponse>;
+
+export interface GetAccessRoleRequest {
+  roleid: string;
+}
+export const GetAccessRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    roleid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/roles/{roleid}", code: 200 })),
+).annotate({
+  identifier: "GetAccessRoleRequest",
+}) as any as S.Schema<GetAccessRoleRequest>;
+
+export interface GetAccessRoleResponse {
+  Datastore_Allocate?: unknown;
+  Datastore_AllocateSpace?: unknown;
+  Datastore_AllocateTemplate?: unknown;
+  Datastore_Audit?: unknown;
+  Group_Allocate?: unknown;
+  Mapping_Audit?: unknown;
+  Mapping_Modify?: unknown;
+  Mapping_Use?: unknown;
+  Permissions_Modify?: unknown;
+  Pool_Allocate?: unknown;
+  Pool_Audit?: unknown;
+  Realm_Allocate?: unknown;
+  Realm_AllocateUser?: unknown;
+  SDN_Allocate?: unknown;
+  SDN_Audit?: unknown;
+  SDN_Use?: unknown;
+  Sys_AccessNetwork?: unknown;
+  Sys_Audit?: unknown;
+  Sys_Console?: unknown;
+  Sys_Incoming?: unknown;
+  Sys_Modify?: unknown;
+  Sys_PowerMgmt?: unknown;
+  Sys_Syslog?: unknown;
+  User_Modify?: unknown;
+  VM_Allocate?: unknown;
+  VM_Audit?: unknown;
+  VM_Backup?: unknown;
+  VM_Clone?: unknown;
+  VM_Config_CDROM?: unknown;
+  VM_Config_CPU?: unknown;
+  VM_Config_Cloudinit?: unknown;
+  VM_Config_Disk?: unknown;
+  VM_Config_HWType?: unknown;
+  VM_Config_Memory?: unknown;
+  VM_Config_Network?: unknown;
+  VM_Config_Options?: unknown;
+  VM_Console?: unknown;
+  VM_GuestAgent_Audit?: unknown;
+  VM_GuestAgent_FileRead?: unknown;
+  VM_GuestAgent_FileSystemMgmt?: unknown;
+  VM_GuestAgent_FileWrite?: unknown;
+  VM_GuestAgent_Unrestricted?: unknown;
+  VM_Migrate?: unknown;
+  VM_PowerMgmt?: unknown;
+  VM_Replicate?: unknown;
+  VM_Snapshot?: unknown;
+  VM_Snapshot_Rollback?: unknown;
+}
+export const GetAccessRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    Datastore_Allocate: S.optional(
+      S.Unknown.pipe(T.Body("Datastore.Allocate")),
+    ),
+    Datastore_AllocateSpace: S.optional(
+      S.Unknown.pipe(T.Body("Datastore.AllocateSpace")),
+    ),
+    Datastore_AllocateTemplate: S.optional(
+      S.Unknown.pipe(T.Body("Datastore.AllocateTemplate")),
+    ),
+    Datastore_Audit: S.optional(S.Unknown.pipe(T.Body("Datastore.Audit"))),
+    Group_Allocate: S.optional(S.Unknown.pipe(T.Body("Group.Allocate"))),
+    Mapping_Audit: S.optional(S.Unknown.pipe(T.Body("Mapping.Audit"))),
+    Mapping_Modify: S.optional(S.Unknown.pipe(T.Body("Mapping.Modify"))),
+    Mapping_Use: S.optional(S.Unknown.pipe(T.Body("Mapping.Use"))),
+    Permissions_Modify: S.optional(
+      S.Unknown.pipe(T.Body("Permissions.Modify")),
+    ),
+    Pool_Allocate: S.optional(S.Unknown.pipe(T.Body("Pool.Allocate"))),
+    Pool_Audit: S.optional(S.Unknown.pipe(T.Body("Pool.Audit"))),
+    Realm_Allocate: S.optional(S.Unknown.pipe(T.Body("Realm.Allocate"))),
+    Realm_AllocateUser: S.optional(
+      S.Unknown.pipe(T.Body("Realm.AllocateUser")),
+    ),
+    SDN_Allocate: S.optional(S.Unknown.pipe(T.Body("SDN.Allocate"))),
+    SDN_Audit: S.optional(S.Unknown.pipe(T.Body("SDN.Audit"))),
+    SDN_Use: S.optional(S.Unknown.pipe(T.Body("SDN.Use"))),
+    Sys_AccessNetwork: S.optional(S.Unknown.pipe(T.Body("Sys.AccessNetwork"))),
+    Sys_Audit: S.optional(S.Unknown.pipe(T.Body("Sys.Audit"))),
+    Sys_Console: S.optional(S.Unknown.pipe(T.Body("Sys.Console"))),
+    Sys_Incoming: S.optional(S.Unknown.pipe(T.Body("Sys.Incoming"))),
+    Sys_Modify: S.optional(S.Unknown.pipe(T.Body("Sys.Modify"))),
+    Sys_PowerMgmt: S.optional(S.Unknown.pipe(T.Body("Sys.PowerMgmt"))),
+    Sys_Syslog: S.optional(S.Unknown.pipe(T.Body("Sys.Syslog"))),
+    User_Modify: S.optional(S.Unknown.pipe(T.Body("User.Modify"))),
+    VM_Allocate: S.optional(S.Unknown.pipe(T.Body("VM.Allocate"))),
+    VM_Audit: S.optional(S.Unknown.pipe(T.Body("VM.Audit"))),
+    VM_Backup: S.optional(S.Unknown.pipe(T.Body("VM.Backup"))),
+    VM_Clone: S.optional(S.Unknown.pipe(T.Body("VM.Clone"))),
+    VM_Config_CDROM: S.optional(S.Unknown.pipe(T.Body("VM.Config.CDROM"))),
+    VM_Config_CPU: S.optional(S.Unknown.pipe(T.Body("VM.Config.CPU"))),
+    VM_Config_Cloudinit: S.optional(
+      S.Unknown.pipe(T.Body("VM.Config.Cloudinit")),
+    ),
+    VM_Config_Disk: S.optional(S.Unknown.pipe(T.Body("VM.Config.Disk"))),
+    VM_Config_HWType: S.optional(S.Unknown.pipe(T.Body("VM.Config.HWType"))),
+    VM_Config_Memory: S.optional(S.Unknown.pipe(T.Body("VM.Config.Memory"))),
+    VM_Config_Network: S.optional(S.Unknown.pipe(T.Body("VM.Config.Network"))),
+    VM_Config_Options: S.optional(S.Unknown.pipe(T.Body("VM.Config.Options"))),
+    VM_Console: S.optional(S.Unknown.pipe(T.Body("VM.Console"))),
+    VM_GuestAgent_Audit: S.optional(
+      S.Unknown.pipe(T.Body("VM.GuestAgent.Audit")),
+    ),
+    VM_GuestAgent_FileRead: S.optional(
+      S.Unknown.pipe(T.Body("VM.GuestAgent.FileRead")),
+    ),
+    VM_GuestAgent_FileSystemMgmt: S.optional(
+      S.Unknown.pipe(T.Body("VM.GuestAgent.FileSystemMgmt")),
+    ),
+    VM_GuestAgent_FileWrite: S.optional(
+      S.Unknown.pipe(T.Body("VM.GuestAgent.FileWrite")),
+    ),
+    VM_GuestAgent_Unrestricted: S.optional(
+      S.Unknown.pipe(T.Body("VM.GuestAgent.Unrestricted")),
+    ),
+    VM_Migrate: S.optional(S.Unknown.pipe(T.Body("VM.Migrate"))),
+    VM_PowerMgmt: S.optional(S.Unknown.pipe(T.Body("VM.PowerMgmt"))),
+    VM_Replicate: S.optional(S.Unknown.pipe(T.Body("VM.Replicate"))),
+    VM_Snapshot: S.optional(S.Unknown.pipe(T.Body("VM.Snapshot"))),
+    VM_Snapshot_Rollback: S.optional(
+      S.Unknown.pipe(T.Body("VM.Snapshot.Rollback")),
+    ),
+  }),
+).annotate({
+  identifier: "GetAccessRoleResponse",
+}) as any as S.Schema<GetAccessRoleResponse>;
+
+export interface GetAccessTfaRequest {
+  userid: string;
+}
+export const GetAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/tfa/{userid}", code: 200 })),
+).annotate({
+  identifier: "GetAccessTfaRequest",
+}) as any as S.Schema<GetAccessTfaRequest>;
+
+export type GetAccessTfaResponseBodyItemType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const GetAccessTfaResponseBodyItemType = S.String;
+
+export interface GetAccessTfaResponseBodyItem {
+  created: number;
+  description: string;
+  enable?: unknown;
+  id: string;
+  type: GetAccessTfaResponseBodyItemType;
+}
+export const GetAccessTfaResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    created: S.Number,
+    description: S.String,
+    enable: S.optional(S.Unknown),
+    id: S.String,
+    type: GetAccessTfaResponseBodyItemType,
+  }),
+).annotate({
+  identifier: "GetAccessTfaResponseBodyItem",
+}) as any as S.Schema<GetAccessTfaResponseBodyItem>;
+
+export type GetAccessTfaResponseBodyList = Array<GetAccessTfaResponseBodyItem>;
+export const GetAccessTfaResponseBodyList = /*@__PURE__*/ S.Array(
+  GetAccessTfaResponseBodyItem,
+) as any as S.Schema<GetAccessTfaResponseBodyList>;
+
+export type GetAccessTfaResponse = GetAccessTfaResponseBodyList;
+export const GetAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  GetAccessTfaResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "GetAccessTfaResponse",
+}) as any as S.Schema<GetAccessTfaResponse>;
+
+export interface GetAccessTfa2Request {
+  userid: string;
+  id: string;
+}
+export const GetAccessTfa2Request = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/tfa/{userid}/{id}", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessTfa2Request",
+}) as any as S.Schema<GetAccessTfa2Request>;
+
+export type GetAccessTfa2ResponseType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const GetAccessTfa2ResponseType = S.String;
+
+export interface GetAccessTfa2Response {
+  created: number;
+  description: string;
+  enable?: unknown;
+  id: string;
+  type: GetAccessTfa2ResponseType;
+}
+export const GetAccessTfa2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    created: S.Number,
+    description: S.String,
+    enable: S.optional(S.Unknown),
+    id: S.String,
+    type: GetAccessTfa2ResponseType,
+  }),
+).annotate({
+  identifier: "GetAccessTfa2Response",
+}) as any as S.Schema<GetAccessTfa2Response>;
+
+export interface GetAccessTicketRequest {}
+export const GetAccessTicketRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/ticket", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessTicketRequest",
+}) as any as S.Schema<GetAccessTicketRequest>;
+
+export interface GetAccessTicketResponse {}
+export const GetAccessTicketResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "GetAccessTicketResponse",
+}) as any as S.Schema<GetAccessTicketResponse>;
+
+export interface GetAccessUserRequest {
+  userid: string;
+}
+export const GetAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/access/users/{userid}", code: 200 })),
+).annotate({
+  identifier: "GetAccessUserRequest",
+}) as any as S.Schema<GetAccessUserRequest>;
+
+export type GetAccessUserResponseGroupsList = Array<string>;
+export const GetAccessUserResponseGroupsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<GetAccessUserResponseGroupsList>;
+
+export interface GetAccessUserResponse {
+  comment?: string;
+  email?: string;
+  enable?: unknown;
+  expire?: number;
+  firstname?: string;
+  groups?: GetAccessUserResponseGroupsList;
+  keys?: string;
+  lastname?: string;
+  tokens?: unknown;
+}
+export const GetAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    firstname: S.optional(S.String),
+    groups: S.optional(GetAccessUserResponseGroupsList),
+    keys: S.optional(S.String),
+    lastname: S.optional(S.String),
+    tokens: S.optional(S.Unknown),
+  }),
+).annotate({
+  identifier: "GetAccessUserResponse",
+}) as any as S.Schema<GetAccessUserResponse>;
+
+export interface GetAccessUserTfaRequest {
+  userid: string;
+  /** Request all entries as an array. */
+  multiple?: string;
+}
+export const GetAccessUserTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    multiple: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/users/{userid}/tfa", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAccessUserTfaRequest",
+}) as any as S.Schema<GetAccessUserTfaRequest>;
+
+export type GetAccessUserTfaResponseRealm = "oath" | "yubico";
+export const GetAccessUserTfaResponseRealm = S.String;
+
+export type GetAccessUserTfaResponseTypesItem =
+  | "totp"
+  | "u2f"
+  | "yubico"
+  | "webauthn"
+  | "recovedry";
+export const GetAccessUserTfaResponseTypesItem = S.String;
+
+export type GetAccessUserTfaResponseTypesList =
+  Array<GetAccessUserTfaResponseTypesItem>;
+export const GetAccessUserTfaResponseTypesList = /*@__PURE__*/ S.Array(
+  GetAccessUserTfaResponseTypesItem,
+) as any as S.Schema<GetAccessUserTfaResponseTypesList>;
+
+export type GetAccessUserTfaResponseUser = "oath" | "u2f";
+export const GetAccessUserTfaResponseUser = S.String;
+
+export interface GetAccessUserTfaResponse {
+  realm?: GetAccessUserTfaResponseRealm;
+  types?: GetAccessUserTfaResponseTypesList;
+  user?: GetAccessUserTfaResponseUser;
+}
+export const GetAccessUserTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.optional(GetAccessUserTfaResponseRealm),
+    types: S.optional(GetAccessUserTfaResponseTypesList),
+    user: S.optional(GetAccessUserTfaResponseUser),
+  }),
+).annotate({
+  identifier: "GetAccessUserTfaResponse",
+}) as any as S.Schema<GetAccessUserTfaResponse>;
+
+export interface GetAccessUserTokenRequest {
+  userid: string;
+  tokenid: string;
+}
+export const GetAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    tokenid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/access/users/{userid}/token/{tokenid}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "GetAccessUserTokenRequest",
+}) as any as S.Schema<GetAccessUserTokenRequest>;
+
+export interface GetAccessUserTokenResponse {
+  comment?: string;
+  expire?: number;
+  privsep?: unknown;
+}
+export const GetAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    expire: S.optional(S.Number),
+    privsep: S.optional(S.Unknown),
+  }),
+).annotate({
+  identifier: "GetAccessUserTokenResponse",
+}) as any as S.Schema<GetAccessUserTokenResponse>;
+
+export interface ListAccessRequest {}
+export const ListAccessRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access", code: 200 })),
+).annotate({
+  identifier: "ListAccessRequest",
+}) as any as S.Schema<ListAccessRequest>;
+
+export interface ListAccessResponseBodyItem {
+  subdir: string;
+}
+export const ListAccessResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    subdir: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessResponseBodyItem",
+}) as any as S.Schema<ListAccessResponseBodyItem>;
+
+export type ListAccessResponseBodyList = Array<ListAccessResponseBodyItem>;
+export const ListAccessResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessResponseBodyItem,
+) as any as S.Schema<ListAccessResponseBodyList>;
+
+export type ListAccessResponse = ListAccessResponseBodyList;
+export const ListAccessResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessResponse",
+}) as any as S.Schema<ListAccessResponse>;
+
+export interface ListAccessAclRequest {}
+export const ListAccessAclRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access/acl", code: 200 })),
+).annotate({
+  identifier: "ListAccessAclRequest",
+}) as any as S.Schema<ListAccessAclRequest>;
+
+export type ListAccessAclResponseBodyItemType = "user" | "group" | "token";
+export const ListAccessAclResponseBodyItemType = S.String;
+
+export interface ListAccessAclResponseBodyItem {
+  path: string;
+  propagate?: unknown;
+  roleid: string;
+  type: ListAccessAclResponseBodyItemType;
+  ugid: string;
+}
+export const ListAccessAclResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String,
+    propagate: S.optional(S.Unknown),
+    roleid: S.String,
+    type: ListAccessAclResponseBodyItemType,
+    ugid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessAclResponseBodyItem",
+}) as any as S.Schema<ListAccessAclResponseBodyItem>;
+
+export type ListAccessAclResponseBodyList =
+  Array<ListAccessAclResponseBodyItem>;
+export const ListAccessAclResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessAclResponseBodyItem,
+) as any as S.Schema<ListAccessAclResponseBodyList>;
+
+export type ListAccessAclResponse = ListAccessAclResponseBodyList;
+export const ListAccessAclResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessAclResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessAclResponse",
+}) as any as S.Schema<ListAccessAclResponse>;
+
+export interface ListAccessDomainsRequest {}
+export const ListAccessDomainsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/domains", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessDomainsRequest",
+}) as any as S.Schema<ListAccessDomainsRequest>;
+
+export type ListAccessDomainsResponseBodyItemTfa = "yubico" | "oath";
+export const ListAccessDomainsResponseBodyItemTfa = S.String;
+
+export interface ListAccessDomainsResponseBodyItem {
+  comment?: string;
+  realm: string;
+  tfa?: ListAccessDomainsResponseBodyItemTfa;
+  type: string;
+}
+export const ListAccessDomainsResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    realm: S.String,
+    tfa: S.optional(ListAccessDomainsResponseBodyItemTfa),
+    type: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessDomainsResponseBodyItem",
+}) as any as S.Schema<ListAccessDomainsResponseBodyItem>;
+
+export type ListAccessDomainsResponseBodyList =
+  Array<ListAccessDomainsResponseBodyItem>;
+export const ListAccessDomainsResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessDomainsResponseBodyItem,
+) as any as S.Schema<ListAccessDomainsResponseBodyList>;
+
+export type ListAccessDomainsResponse = ListAccessDomainsResponseBodyList;
+export const ListAccessDomainsResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessDomainsResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessDomainsResponse",
+}) as any as S.Schema<ListAccessDomainsResponse>;
+
+export interface ListAccessGroupsRequest {}
+export const ListAccessGroupsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/groups", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessGroupsRequest",
+}) as any as S.Schema<ListAccessGroupsRequest>;
+
+export interface ListAccessGroupsResponseBodyItem {
+  comment?: string;
+  groupid: string;
+  users?: string;
+}
+export const ListAccessGroupsResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    groupid: S.String,
+    users: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ListAccessGroupsResponseBodyItem",
+}) as any as S.Schema<ListAccessGroupsResponseBodyItem>;
+
+export type ListAccessGroupsResponseBodyList =
+  Array<ListAccessGroupsResponseBodyItem>;
+export const ListAccessGroupsResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessGroupsResponseBodyItem,
+) as any as S.Schema<ListAccessGroupsResponseBodyList>;
+
+export type ListAccessGroupsResponse = ListAccessGroupsResponseBodyList;
+export const ListAccessGroupsResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessGroupsResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessGroupsResponse",
+}) as any as S.Schema<ListAccessGroupsResponse>;
+
+export interface ListAccessOpenidRequest {}
+export const ListAccessOpenidRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/access/openid", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessOpenidRequest",
+}) as any as S.Schema<ListAccessOpenidRequest>;
+
+export type ListAccessOpenidResponseBodyItem = ListAccessResponseBodyItem;
+export const ListAccessOpenidResponseBodyItem = ListAccessResponseBodyItem;
+
+export type ListAccessOpenidResponseBodyList =
+  Array<ListAccessResponseBodyItem>;
+export const ListAccessOpenidResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessResponseBodyItem,
+) as any as S.Schema<ListAccessOpenidResponseBodyList>;
+
+export type ListAccessOpenidResponse = ListAccessOpenidResponseBodyList;
+export const ListAccessOpenidResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessOpenidResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessOpenidResponse",
+}) as any as S.Schema<ListAccessOpenidResponse>;
+
+export interface ListAccessRolesRequest {}
+export const ListAccessRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access/roles", code: 200 })),
+).annotate({
+  identifier: "ListAccessRolesRequest",
+}) as any as S.Schema<ListAccessRolesRequest>;
+
+export interface ListAccessRolesResponseBodyItem {
+  privs?: string;
+  roleid: string;
+  special?: unknown;
+}
+export const ListAccessRolesResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    privs: S.optional(S.String),
+    roleid: S.String,
+    special: S.optional(S.Unknown),
+  }),
+).annotate({
+  identifier: "ListAccessRolesResponseBodyItem",
+}) as any as S.Schema<ListAccessRolesResponseBodyItem>;
+
+export type ListAccessRolesResponseBodyList =
+  Array<ListAccessRolesResponseBodyItem>;
+export const ListAccessRolesResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessRolesResponseBodyItem,
+) as any as S.Schema<ListAccessRolesResponseBodyList>;
+
+export type ListAccessRolesResponse = ListAccessRolesResponseBodyList;
+export const ListAccessRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessRolesResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessRolesResponse",
+}) as any as S.Schema<ListAccessRolesResponse>;
+
+export interface ListAccessTfaRequest {}
+export const ListAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/access/tfa", code: 200 })),
+).annotate({
+  identifier: "ListAccessTfaRequest",
+}) as any as S.Schema<ListAccessTfaRequest>;
+
+export type ListAccessTfaResponseBodyItemEntriesItemType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const ListAccessTfaResponseBodyItemEntriesItemType = S.String;
+
+export interface ListAccessTfaResponseBodyItemEntriesItem {
+  created: number;
+  description: string;
+  enable?: unknown;
+  id: string;
+  type: ListAccessTfaResponseBodyItemEntriesItemType;
+}
+export const ListAccessTfaResponseBodyItemEntriesItem = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      created: S.Number,
+      description: S.String,
+      enable: S.optional(S.Unknown),
+      id: S.String,
+      type: ListAccessTfaResponseBodyItemEntriesItemType,
+    }),
+).annotate({
+  identifier: "ListAccessTfaResponseBodyItemEntriesItem",
+}) as any as S.Schema<ListAccessTfaResponseBodyItemEntriesItem>;
+
+export type ListAccessTfaResponseBodyItemEntriesList =
+  Array<ListAccessTfaResponseBodyItemEntriesItem>;
+export const ListAccessTfaResponseBodyItemEntriesList = /*@__PURE__*/ S.Array(
+  ListAccessTfaResponseBodyItemEntriesItem,
+) as any as S.Schema<ListAccessTfaResponseBodyItemEntriesList>;
+
+export interface ListAccessTfaResponseBodyItem {
+  entries: ListAccessTfaResponseBodyItemEntriesList;
+  tfa_locked_until?: number;
+  totp_locked?: unknown;
+  userid: string;
+}
+export const ListAccessTfaResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    entries: ListAccessTfaResponseBodyItemEntriesList,
+    tfa_locked_until: S.optional(S.Number.pipe(T.Body("tfa-locked-until"))),
+    totp_locked: S.optional(S.Unknown.pipe(T.Body("totp-locked"))),
+    userid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessTfaResponseBodyItem",
+}) as any as S.Schema<ListAccessTfaResponseBodyItem>;
+
+export type ListAccessTfaResponseBodyList =
+  Array<ListAccessTfaResponseBodyItem>;
+export const ListAccessTfaResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessTfaResponseBodyItem,
+) as any as S.Schema<ListAccessTfaResponseBodyList>;
+
+export type ListAccessTfaResponse = ListAccessTfaResponseBodyList;
+export const ListAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessTfaResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessTfaResponse",
+}) as any as S.Schema<ListAccessTfaResponse>;
+
+export interface ListAccessUsersRequest {
+  /** Optional filter for enable property. */
+  enabled?: string;
+  /** Include group and token information. */
+  full?: string;
+}
+export const ListAccessUsersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enabled: S.optional(S.String.pipe(T.Query())),
+    full: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/access/users", code: 200 })),
+).annotate({
+  identifier: "ListAccessUsersRequest",
+}) as any as S.Schema<ListAccessUsersRequest>;
+
+export interface ListAccessUsersResponseBodyItemTokensItem {
+  comment?: string;
+  expire?: number;
+  privsep?: unknown;
+  tokenid: string;
+}
+export const ListAccessUsersResponseBodyItemTokensItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      comment: S.optional(S.String),
+      expire: S.optional(S.Number),
+      privsep: S.optional(S.Unknown),
+      tokenid: S.String,
+    }),
+  ).annotate({
+    identifier: "ListAccessUsersResponseBodyItemTokensItem",
+  }) as any as S.Schema<ListAccessUsersResponseBodyItemTokensItem>;
+
+export type ListAccessUsersResponseBodyItemTokensList =
+  Array<ListAccessUsersResponseBodyItemTokensItem>;
+export const ListAccessUsersResponseBodyItemTokensList = /*@__PURE__*/ S.Array(
+  ListAccessUsersResponseBodyItemTokensItem,
+) as any as S.Schema<ListAccessUsersResponseBodyItemTokensList>;
+
+export interface ListAccessUsersResponseBodyItem {
+  comment?: string;
+  email?: string;
+  enable?: unknown;
+  expire?: number;
+  firstname?: string;
+  groups?: string;
+  keys?: string;
+  lastname?: string;
+  realm_type?: string;
+  tfa_locked_until?: number;
+  tokens?: ListAccessUsersResponseBodyItemTokensList;
+  totp_locked?: unknown;
+  userid: string;
+}
+export const ListAccessUsersResponseBodyItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.Unknown),
+    expire: S.optional(S.Number),
+    firstname: S.optional(S.String),
+    groups: S.optional(S.String),
+    keys: S.optional(S.String),
+    lastname: S.optional(S.String),
+    realm_type: S.optional(S.String.pipe(T.Body("realm-type"))),
+    tfa_locked_until: S.optional(S.Number.pipe(T.Body("tfa-locked-until"))),
+    tokens: S.optional(ListAccessUsersResponseBodyItemTokensList),
+    totp_locked: S.optional(S.Unknown.pipe(T.Body("totp-locked"))),
+    userid: S.String,
+  }),
+).annotate({
+  identifier: "ListAccessUsersResponseBodyItem",
+}) as any as S.Schema<ListAccessUsersResponseBodyItem>;
+
+export type ListAccessUsersResponseBodyList =
+  Array<ListAccessUsersResponseBodyItem>;
+export const ListAccessUsersResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessUsersResponseBodyItem,
+) as any as S.Schema<ListAccessUsersResponseBodyList>;
+
+export type ListAccessUsersResponse = ListAccessUsersResponseBodyList;
+export const ListAccessUsersResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessUsersResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessUsersResponse",
+}) as any as S.Schema<ListAccessUsersResponse>;
+
+export interface ListAccessUserTokenRequest {
+  userid: string;
+}
+export const ListAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/access/users/{userid}/token", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAccessUserTokenRequest",
+}) as any as S.Schema<ListAccessUserTokenRequest>;
+
+export type ListAccessUserTokenResponseBodyItem =
+  ListAccessUsersResponseBodyItemTokensItem;
+export const ListAccessUserTokenResponseBodyItem =
+  ListAccessUsersResponseBodyItemTokensItem;
+
+export type ListAccessUserTokenResponseBodyList =
+  Array<ListAccessUsersResponseBodyItemTokensItem>;
+export const ListAccessUserTokenResponseBodyList = /*@__PURE__*/ S.Array(
+  ListAccessUsersResponseBodyItemTokensItem,
+) as any as S.Schema<ListAccessUserTokenResponseBodyList>;
+
+export type ListAccessUserTokenResponse = ListAccessUserTokenResponseBodyList;
+export const ListAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAccessUserTokenResponseBodyList.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAccessUserTokenResponse",
+}) as any as S.Schema<ListAccessUserTokenResponse>;
+
+export interface LoginAccessOpenidRequest {
+  /** OpenId authorization code. */
+  code: string;
+  /** Redirection Url. The client should set this to the used server url (location.origin). */
+  redirect_url: string;
+  /** OpenId state. */
+  state: string;
+}
+export const LoginAccessOpenidRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.String,
+    redirect_url: S.String.pipe(T.Body("redirect-url")),
+    state: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/openid/login",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "LoginAccessOpenidRequest",
+}) as any as S.Schema<LoginAccessOpenidRequest>;
+
+export type LoginAccessOpenidResponse = unknown;
+export const LoginAccessOpenidResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "LoginAccessOpenidResponse",
+}) as any as S.Schema<LoginAccessOpenidResponse>;
+
+export interface PutAccessAclRequest {
+  /** Remove permissions (instead of adding it). */
+  delete?: string;
+  /** List of groups. */
+  groups?: string;
+  /** Access control path */
+  path: string;
+  /** Allow to propagate (inherit) permissions. */
+  propagate?: string;
+  /** List of roles. */
+  roles: string;
+  /** List of API tokens. */
+  tokens?: string;
+  /** List of users. */
+  users?: string;
+}
+export const PutAccessAclRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    delete: S.optional(S.String),
+    groups: S.optional(S.String),
+    path: S.String,
+    propagate: S.optional(S.String),
+    roles: S.String,
+    tokens: S.optional(S.String),
+    users: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/acl",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessAclRequest",
+}) as any as S.Schema<PutAccessAclRequest>;
+
+export interface PutAccessAclResponse {}
+export const PutAccessAclResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessAclResponse",
+}) as any as S.Schema<PutAccessAclResponse>;
+
+export type PutAccessDomainRequestMode = "ldap" | "ldaps" | "ldap+starttls";
+export const PutAccessDomainRequestMode = S.String;
+
+export type PutAccessDomainRequestSslversion =
+  | "tlsv1"
+  | "tlsv1_1"
+  | "tlsv1_2"
+  | "tlsv1_3";
+export const PutAccessDomainRequestSslversion = S.String;
+
+export interface PutAccessDomainRequest {
+  realm: string;
+  /** Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request. */
+  acr_values?: string;
+  /** A list of audiences that the OpenID Issuer may include that are accepted in addition to 'client-id'. */
+  audiences?: string;
+  /** Automatically create users if they do not exist. */
+  autocreate?: string;
+  /** LDAP base domain name */
+  base_dn?: string;
+  /** LDAP bind domain name */
+  bind_dn?: string;
+  /** Path to the CA certificate store */
+  capath?: string;
+  /** username is case-sensitive */
+  case_sensitive?: string;
+  /** Path to the client certificate */
+  cert?: string;
+  /** Path to the client certificate key */
+  certkey?: string;
+  /** Check bind connection to the server. */
+  check_connection?: string;
+  /** OpenID Client ID */
+  client_id?: string;
+  /** OpenID Client Key */
+  client_key?: string;
+  /** Description. */
+  comment?: string;
+  /** Use this as default realm */
+  default?: string;
+  /** A list of settings you want to delete. */
+  delete?: string;
+  /** Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. */
+  digest?: string;
+  /** AD domain name */
+  domain?: string;
+  /** LDAP filter for user sync. */
+  filter?: string;
+  /** The objectclasses for groups. */
+  group_classes?: string;
+  /** LDAP base domain name for group sync. If not set, the base_dn will be used. */
+  group_dn?: string;
+  /** LDAP filter for group sync. */
+  group_filter?: string;
+  /** LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name. */
+  group_name_attr?: string;
+  /** Automatically create groups if they do not exist. */
+  groups_autocreate?: string;
+  /** OpenID claim used to retrieve groups with. */
+  groups_claim?: string;
+  /** All groups will be overwritten for the user on login. */
+  groups_overwrite?: string;
+  /** OpenID Issuer Url */
+  issuer_url?: string;
+  /** LDAP protocol mode. */
+  mode?: PutAccessDomainRequestMode | (string & {});
+  /** LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'. */
+  password?: string;
+  /** Server port. */
+  port?: string;
+  /** Specifies whether the Authorization Server prompts the End-User for reauthentication and consent. */
+  prompt?: string;
+  /** Enables querying the userinfo endpoint for claims values. */
+  query_userinfo?: string;
+  /** Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'. */
+  scopes?: string;
+  /** Use secure LDAPS protocol. DEPRECATED: use 'mode' instead. */
+  secure?: string;
+  /** Server IP address (or DNS name) */
+  server1?: string;
+  /** Fallback Server IP address (or DNS name) */
+  server2?: string;
+  /** LDAPS TLS/SSL version. It's not recommended to use version older than 1.2! */
+  sslversion?: PutAccessDomainRequestSslversion | (string & {});
+  /** The default options for behavior of synchronizations. */
+  sync_defaults_options?: string;
+  /** Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write 'email=mail'. By default, each PVE user field is represented by an LDAP attribute of the same name. */
+  sync_attributes?: string;
+  /** Use Two-factor authentication. */
+  tfa?: string;
+  /** LDAP user attribute name */
+  user_attr?: string;
+  /** The objectclasses for users. */
+  user_classes?: string;
+  /** Verify the server's SSL certificate */
+  verify?: string;
+}
+export const PutAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String.pipe(T.Label()),
+    acr_values: S.optional(S.String.pipe(T.Body("acr-values"))),
+    audiences: S.optional(S.String),
+    autocreate: S.optional(S.String),
+    base_dn: S.optional(S.String),
+    bind_dn: S.optional(S.String),
+    capath: S.optional(S.String),
+    case_sensitive: S.optional(S.String.pipe(T.Body("case-sensitive"))),
+    cert: S.optional(S.String),
+    certkey: S.optional(S.String),
+    check_connection: S.optional(S.String.pipe(T.Body("check-connection"))),
+    client_id: S.optional(S.String.pipe(T.Body("client-id"))),
+    client_key: S.optional(S.String.pipe(T.Body("client-key"))),
+    comment: S.optional(S.String),
+    default: S.optional(S.String),
+    delete: S.optional(S.String),
+    digest: S.optional(S.String),
+    domain: S.optional(S.String),
+    filter: S.optional(S.String),
+    group_classes: S.optional(S.String),
+    group_dn: S.optional(S.String),
+    group_filter: S.optional(S.String),
+    group_name_attr: S.optional(S.String),
+    groups_autocreate: S.optional(S.String.pipe(T.Body("groups-autocreate"))),
+    groups_claim: S.optional(S.String.pipe(T.Body("groups-claim"))),
+    groups_overwrite: S.optional(S.String.pipe(T.Body("groups-overwrite"))),
+    issuer_url: S.optional(S.String.pipe(T.Body("issuer-url"))),
+    mode: S.optional(PutAccessDomainRequestMode),
+    password: S.optional(S.String),
+    port: S.optional(S.String),
+    prompt: S.optional(S.String),
+    query_userinfo: S.optional(S.String.pipe(T.Body("query-userinfo"))),
+    scopes: S.optional(S.String),
+    secure: S.optional(S.String),
+    server1: S.optional(S.String),
+    server2: S.optional(S.String),
+    sslversion: S.optional(PutAccessDomainRequestSslversion),
+    sync_defaults_options: S.optional(
+      S.String.pipe(T.Body("sync-defaults-options")),
+    ),
+    sync_attributes: S.optional(S.String),
+    tfa: S.optional(S.String),
+    user_attr: S.optional(S.String),
+    user_classes: S.optional(S.String),
+    verify: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/domains/{realm}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessDomainRequest",
+}) as any as S.Schema<PutAccessDomainRequest>;
+
+export interface PutAccessDomainResponse {}
+export const PutAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessDomainResponse",
+}) as any as S.Schema<PutAccessDomainResponse>;
+
+export interface PutAccessGroupRequest {
+  groupid: string;
+  comment?: string;
+}
+export const PutAccessGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    groupid: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/groups/{groupid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessGroupRequest",
+}) as any as S.Schema<PutAccessGroupRequest>;
+
+export interface PutAccessGroupResponse {}
+export const PutAccessGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessGroupResponse",
+}) as any as S.Schema<PutAccessGroupResponse>;
+
+export interface PutAccessPasswordRequest {
+  /** The current password of the user performing the change. */
+  confirmation_password?: string;
+  /** The new password. */
+  password: string;
+  /** Full User ID, in the `name@realm` format. */
+  userid: string;
+}
+export const PutAccessPasswordRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    confirmation_password: S.optional(
+      S.String.pipe(T.Body("confirmation-password")),
+    ),
+    password: S.String,
+    userid: S.String,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/password",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessPasswordRequest",
+}) as any as S.Schema<PutAccessPasswordRequest>;
+
+export interface PutAccessPasswordResponse {}
+export const PutAccessPasswordResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessPasswordResponse",
+}) as any as S.Schema<PutAccessPasswordResponse>;
+
+export interface PutAccessRoleRequest {
+  roleid: string;
+  append?: string;
+  privs?: string;
+}
+export const PutAccessRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    roleid: S.String.pipe(T.Label()),
+    append: S.optional(S.String),
+    privs: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/roles/{roleid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessRoleRequest",
+}) as any as S.Schema<PutAccessRoleRequest>;
+
+export interface PutAccessRoleResponse {}
+export const PutAccessRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessRoleResponse",
+}) as any as S.Schema<PutAccessRoleResponse>;
+
+export interface PutAccessTfaRequest {
+  userid: string;
+  id: string;
+  /** A description to distinguish multiple entries from one another */
+  description?: string;
+  /** Whether the entry should be enabled for login. */
+  enable?: string;
+  /** The current password of the user performing the change. */
+  password?: string;
+}
+export const PutAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    id: S.String.pipe(T.Label()),
+    description: S.optional(S.String),
+    enable: S.optional(S.String),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/tfa/{userid}/{id}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessTfaRequest",
+}) as any as S.Schema<PutAccessTfaRequest>;
+
+export interface PutAccessTfaResponse {}
+export const PutAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessTfaResponse",
+}) as any as S.Schema<PutAccessTfaResponse>;
+
+export interface PutAccessUserRequest {
+  userid: string;
+  append?: string;
+  comment?: string;
+  email?: string;
+  /** Enable the account (default). You can set this to '0' to disable the account */
+  enable?: string;
+  /** Account expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  firstname?: string;
+  groups?: string;
+  /** Keys for two factor auth (yubico). */
+  keys?: string;
+  lastname?: string;
+}
+export const PutAccessUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    append: S.optional(S.String),
+    comment: S.optional(S.String),
+    email: S.optional(S.String),
+    enable: S.optional(S.String),
+    expire: S.optional(S.String),
+    firstname: S.optional(S.String),
+    groups: S.optional(S.String),
+    keys: S.optional(S.String),
+    lastname: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserRequest",
+}) as any as S.Schema<PutAccessUserRequest>;
+
+export interface PutAccessUserResponse {}
+export const PutAccessUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PutAccessUserResponse",
+}) as any as S.Schema<PutAccessUserResponse>;
+
+export interface PutAccessUserTokenRequest {
+  userid: string;
+  tokenid: string;
+  comment?: string;
+  /** A list of settings you want to delete. */
+  delete?: string;
+  /** API token expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  /** Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user. */
+  privsep?: string;
+  /** Regenerate the token's secret value. All users of the previous secret will lose access after this operation. */
+  regenerate?: string;
+}
+export const PutAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    tokenid: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+    delete: S.optional(S.String),
+    expire: S.optional(S.String),
+    privsep: S.optional(S.String),
+    regenerate: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}/token/{tokenid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserTokenRequest",
+}) as any as S.Schema<PutAccessUserTokenRequest>;
+
+export interface PutAccessUserTokenResponse {
+  comment?: string;
+  expire?: number;
+  full_tokenid?: string;
+  privsep?: unknown;
+  value?: string;
+}
+export const PutAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    expire: S.optional(S.Number),
+    full_tokenid: S.optional(S.String.pipe(T.Body("full-tokenid"))),
+    privsep: S.optional(S.Unknown),
+    value: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "PutAccessUserTokenResponse",
+}) as any as S.Schema<PutAccessUserTokenResponse>;
+
+export interface PutAccessUserUnlockTfaRequest {
+  userid: string;
+}
+export const PutAccessUserUnlockTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/access/users/{userid}/unlock-tfa",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PutAccessUserUnlockTfaRequest",
+}) as any as S.Schema<PutAccessUserUnlockTfaRequest>;
+
+export type PutAccessUserUnlockTfaResponse = unknown;
+export const PutAccessUserUnlockTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "PutAccessUserUnlockTfaResponse",
+}) as any as S.Schema<PutAccessUserUnlockTfaResponse>;
+
+export type SyncAccessDomainRequestScope = "users" | "groups" | "both";
+export const SyncAccessDomainRequestScope = S.String;
+
+export interface SyncAccessDomainRequest {
+  realm: string;
+  /** If set, does not write anything. */
+  dry_run?: string;
+  /** Enable newly synced users immediately. */
+  enable_new: string;
+  /** DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else. */
+  full: string;
+  /** DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync. */
+  purge: string;
+  /** A semicolon-separated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync. Instead of a list it also can be 'none' (the default). */
+  remove_vanished: string;
+  /** Select what to sync. */
+  scope: SyncAccessDomainRequestScope | (string & {});
+}
+export const SyncAccessDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    realm: S.String.pipe(T.Label()),
+    dry_run: S.optional(S.String.pipe(T.Body("dry-run"))),
+    enable_new: S.String.pipe(T.Body("enable-new")),
+    full: S.String,
+    purge: S.String,
+    remove_vanished: S.String.pipe(T.Body("remove-vanished")),
+    scope: SyncAccessDomainRequestScope,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/domains/{realm}/sync",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "SyncAccessDomainRequest",
+}) as any as S.Schema<SyncAccessDomainRequest>;
+
+export type SyncAccessDomainResponse = string;
+export const SyncAccessDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.String.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "SyncAccessDomainResponse",
+}) as any as S.Schema<SyncAccessDomainResponse>;
+
+export type UpdateAccessTfaRequestType =
+  | "totp"
+  | "u2f"
+  | "webauthn"
+  | "recovery"
+  | "yubico";
+export const UpdateAccessTfaRequestType = S.String;
+
+export interface UpdateAccessTfaRequest {
+  userid: string;
+  /** When responding to a u2f challenge: the original challenge string */
+  challenge?: string;
+  /** A description to distinguish multiple entries from one another */
+  description?: string;
+  /** The current password of the user performing the change. */
+  password?: string;
+  /** A totp URI. */
+  totp?: string;
+  /** TFA Entry Type. */
+  type: UpdateAccessTfaRequestType | (string & {});
+  /** The current value for the provided totp URI, or a Webauthn/U2F challenge response */
+  value?: string;
+}
+export const UpdateAccessTfaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    challenge: S.optional(S.String),
+    description: S.optional(S.String),
+    password: S.optional(S.String),
+    totp: S.optional(S.String),
+    type: UpdateAccessTfaRequestType,
+    value: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/tfa/{userid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateAccessTfaRequest",
+}) as any as S.Schema<UpdateAccessTfaRequest>;
+
+export type UpdateAccessTfaResponseRecoveryList = Array<string>;
+export const UpdateAccessTfaResponseRecoveryList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateAccessTfaResponseRecoveryList>;
+
+export interface UpdateAccessTfaResponse {
+  challenge?: string;
+  id: string;
+  recovery?: UpdateAccessTfaResponseRecoveryList;
+}
+export const UpdateAccessTfaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    challenge: S.optional(S.String),
+    id: S.String,
+    recovery: S.optional(UpdateAccessTfaResponseRecoveryList),
+  }),
+).annotate({
+  identifier: "UpdateAccessTfaResponse",
+}) as any as S.Schema<UpdateAccessTfaResponse>;
+
+export interface UpdateAccessUserTokenRequest {
+  userid: string;
+  tokenid: string;
+  comment?: string;
+  /** API token expiration date (seconds since epoch). '0' means no expiration date. */
+  expire?: string;
+  /** Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user. */
+  privsep?: string;
+}
+export const UpdateAccessUserTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userid: S.String.pipe(T.Label()),
+    tokenid: S.String.pipe(T.Label()),
+    comment: S.optional(S.String),
+    expire: S.optional(S.String),
+    privsep: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/access/users/{userid}/token/{tokenid}",
+      code: 200,
+      contentType: "form-urlencoded",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateAccessUserTokenRequest",
+}) as any as S.Schema<UpdateAccessUserTokenRequest>;
+
+export interface UpdateAccessUserTokenResponseInfo {
+  comment?: string;
+  expire?: number;
+  privsep?: unknown;
+}
+export const UpdateAccessUserTokenResponseInfo = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    comment: S.optional(S.String),
+    expire: S.optional(S.Number),
+    privsep: S.optional(S.Unknown),
+  }),
+).annotate({
+  identifier: "UpdateAccessUserTokenResponseInfo",
+}) as any as S.Schema<UpdateAccessUserTokenResponseInfo>;
+
+export interface UpdateAccessUserTokenResponse {
+  full_tokenid?: string;
+  info: UpdateAccessUserTokenResponseInfo;
+  value: string;
+}
+export const UpdateAccessUserTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    full_tokenid: S.optional(S.String.pipe(T.Body("full-tokenid"))),
+    info: UpdateAccessUserTokenResponseInfo,
+    value: S.String,
+  }),
+).annotate({
+  identifier: "UpdateAccessUserTokenResponse",
+}) as any as S.Schema<UpdateAccessUserTokenResponse>;
+
+export type CreateAccessDomainError = ProxmoxOpError;
+/** Add an authentication server. (root-privileged endpoint) */
+export const createAccessDomain: API.OperationMethod<
+  CreateAccessDomainRequest,
+  CreateAccessDomainResponse,
+  CreateAccessDomainError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessDomainRequest,
+  output: CreateAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessGroupError = ProxmoxOpError;
+/** Create new group. (root-privileged endpoint) */
+export const createAccessGroup: API.OperationMethod<
+  CreateAccessGroupRequest,
+  CreateAccessGroupResponse,
+  CreateAccessGroupError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessGroupRequest,
+  output: CreateAccessGroupResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessOpenidAuthUrlError = ProxmoxOpError;
+/** Get the OpenId Authorization Url for the specified realm. (root-privileged endpoint) */
+export const createAccessOpenidAuthUrl: API.OperationMethod<
+  CreateAccessOpenidAuthUrlRequest,
+  CreateAccessOpenidAuthUrlResponse,
+  CreateAccessOpenidAuthUrlError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessOpenidAuthUrlRequest,
+  output: CreateAccessOpenidAuthUrlResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessRoleError = ProxmoxOpError;
+/** Create new role. (root-privileged endpoint) */
+export const createAccessRole: API.OperationMethod<
+  CreateAccessRoleRequest,
+  CreateAccessRoleResponse,
+  CreateAccessRoleError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessRoleRequest,
+  output: CreateAccessRoleResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessTicketError = ProxmoxOpError;
+/** Create or verify authentication ticket. (root-privileged endpoint) */
+export const createAccessTicket: API.OperationMethod<
+  CreateAccessTicketRequest,
+  CreateAccessTicketResponse,
+  CreateAccessTicketError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessTicketRequest,
+  output: CreateAccessTicketResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessUserError = ProxmoxOpError;
+/** Create new user. (root-privileged endpoint) */
+export const createAccessUser: API.OperationMethod<
+  CreateAccessUserRequest,
+  CreateAccessUserResponse,
+  CreateAccessUserError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessUserRequest,
+  output: CreateAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAccessVncticketError = ProxmoxOpError;
+/** verify VNC authentication ticket. (root-privileged endpoint) */
+export const createAccessVncticket: API.OperationMethod<
+  CreateAccessVncticketRequest,
+  CreateAccessVncticketResponse,
+  CreateAccessVncticketError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAccessVncticketRequest,
+  output: CreateAccessVncticketResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessDomainError = ProxmoxOpError;
+/** Delete an authentication server. (root-privileged endpoint) */
+export const deleteAccessDomain: API.OperationMethod<
+  DeleteAccessDomainRequest,
+  DeleteAccessDomainResponse,
+  DeleteAccessDomainError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessDomainRequest,
+  output: DeleteAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessGroupError = ProxmoxOpError;
+/** Delete group. (root-privileged endpoint) */
+export const deleteAccessGroup: API.OperationMethod<
+  DeleteAccessGroupRequest,
+  DeleteAccessGroupResponse,
+  DeleteAccessGroupError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessGroupRequest,
+  output: DeleteAccessGroupResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessRoleError = ProxmoxOpError;
+/** Delete role. (root-privileged endpoint) */
+export const deleteAccessRole: API.OperationMethod<
+  DeleteAccessRoleRequest,
+  DeleteAccessRoleResponse,
+  DeleteAccessRoleError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessRoleRequest,
+  output: DeleteAccessRoleResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessTfaError = ProxmoxOpError;
+/** Delete a TFA entry by ID. (root-privileged endpoint) */
+export const deleteAccessTfa: API.OperationMethod<
+  DeleteAccessTfaRequest,
+  DeleteAccessTfaResponse,
+  DeleteAccessTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessTfaRequest,
+  output: DeleteAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessUserError = ProxmoxOpError;
+/** Delete user. (root-privileged endpoint) */
+export const deleteAccessUser: API.OperationMethod<
+  DeleteAccessUserRequest,
+  DeleteAccessUserResponse,
+  DeleteAccessUserError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessUserRequest,
+  output: DeleteAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAccessUserTokenError = ProxmoxOpError;
+/** Remove API token for a specific user. (root-privileged endpoint) */
+export const deleteAccessUserToken: API.OperationMethod<
+  DeleteAccessUserTokenRequest,
+  DeleteAccessUserTokenResponse,
+  DeleteAccessUserTokenError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAccessUserTokenRequest,
+  output: DeleteAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessDomainError = ProxmoxOpError;
+/** Get auth server configuration. */
+export const getAccessDomain: API.OperationMethod<
+  GetAccessDomainRequest,
+  GetAccessDomainResponse,
+  GetAccessDomainError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessDomainRequest,
+  output: GetAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessGroupError = ProxmoxOpError;
+/** Get group configuration. */
+export const getAccessGroup: API.OperationMethod<
+  GetAccessGroupRequest,
+  GetAccessGroupResponse,
+  GetAccessGroupError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessGroupRequest,
+  output: GetAccessGroupResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessPermissionsError = ProxmoxOpError;
+/** Retrieve effective permissions of given user/token. */
+export const getAccessPermissions: API.OperationMethod<
+  GetAccessPermissionsRequest,
+  GetAccessPermissionsResponse,
+  GetAccessPermissionsError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessPermissionsRequest,
+  output: GetAccessPermissionsResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessRoleError = ProxmoxOpError;
+/** Get role configuration. */
+export const getAccessRole: API.OperationMethod<
+  GetAccessRoleRequest,
+  GetAccessRoleResponse,
+  GetAccessRoleError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessRoleRequest,
+  output: GetAccessRoleResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessTfaError = ProxmoxOpError;
+/** List TFA configurations of users. (root-privileged endpoint) */
+export const getAccessTfa: API.OperationMethod<
+  GetAccessTfaRequest,
+  GetAccessTfaResponse,
+  GetAccessTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessTfaRequest,
+  output: GetAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessTfa2Error = ProxmoxOpError;
+/** Fetch a requested TFA entry if present. (root-privileged endpoint) */
+export const getAccessTfa2: API.OperationMethod<
+  GetAccessTfa2Request,
+  GetAccessTfa2Response,
+  GetAccessTfa2Error,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessTfa2Request,
+  output: GetAccessTfa2Response,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessTicketError = ProxmoxOpError;
+/** Dummy. Useful for formatters which want to provide a login page. */
+export const getAccessTicket: API.OperationMethod<
+  GetAccessTicketRequest,
+  GetAccessTicketResponse,
+  GetAccessTicketError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessTicketRequest,
+  output: GetAccessTicketResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessUserError = ProxmoxOpError;
+/** Get user configuration. */
+export const getAccessUser: API.OperationMethod<
+  GetAccessUserRequest,
+  GetAccessUserResponse,
+  GetAccessUserError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessUserRequest,
+  output: GetAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessUserTfaError = ProxmoxOpError;
+/** Get user TFA types (Personal and Realm). (root-privileged endpoint) */
+export const getAccessUserTfa: API.OperationMethod<
+  GetAccessUserTfaRequest,
+  GetAccessUserTfaResponse,
+  GetAccessUserTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessUserTfaRequest,
+  output: GetAccessUserTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAccessUserTokenError = ProxmoxOpError;
+/** Get specific API token information. */
+export const getAccessUserToken: API.OperationMethod<
+  GetAccessUserTokenRequest,
+  GetAccessUserTokenResponse,
+  GetAccessUserTokenError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAccessUserTokenRequest,
+  output: GetAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessError = ProxmoxOpError;
+/** Directory index. */
+export const listAccess: API.OperationMethod<
+  ListAccessRequest,
+  ListAccessResponse,
+  ListAccessError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessRequest,
+  output: ListAccessResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessAclError = ProxmoxOpError;
+/** Get Access Control List (ACLs). */
+export const listAccessAcl: API.OperationMethod<
+  ListAccessAclRequest,
+  ListAccessAclResponse,
+  ListAccessAclError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessAclRequest,
+  output: ListAccessAclResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessDomainsError = ProxmoxOpError;
+/** Authentication domain index. */
+export const listAccessDomains: API.OperationMethod<
+  ListAccessDomainsRequest,
+  ListAccessDomainsResponse,
+  ListAccessDomainsError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessDomainsRequest,
+  output: ListAccessDomainsResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessGroupsError = ProxmoxOpError;
+/** Group index. */
+export const listAccessGroups: API.OperationMethod<
+  ListAccessGroupsRequest,
+  ListAccessGroupsResponse,
+  ListAccessGroupsError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessGroupsRequest,
+  output: ListAccessGroupsResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessOpenidError = ProxmoxOpError;
+/** Directory index. */
+export const listAccessOpenid: API.OperationMethod<
+  ListAccessOpenidRequest,
+  ListAccessOpenidResponse,
+  ListAccessOpenidError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessOpenidRequest,
+  output: ListAccessOpenidResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessRolesError = ProxmoxOpError;
+/** Role index. */
+export const listAccessRoles: API.OperationMethod<
+  ListAccessRolesRequest,
+  ListAccessRolesResponse,
+  ListAccessRolesError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessRolesRequest,
+  output: ListAccessRolesResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessTfaError = ProxmoxOpError;
+/** List TFA configurations of users. (root-privileged endpoint) */
+export const listAccessTfa: API.OperationMethod<
+  ListAccessTfaRequest,
+  ListAccessTfaResponse,
+  ListAccessTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessTfaRequest,
+  output: ListAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessUsersError = ProxmoxOpError;
+/** User index. (root-privileged endpoint) */
+export const listAccessUsers: API.OperationMethod<
+  ListAccessUsersRequest,
+  ListAccessUsersResponse,
+  ListAccessUsersError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessUsersRequest,
+  output: ListAccessUsersResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAccessUserTokenError = ProxmoxOpError;
+/** Get user API tokens. */
+export const listAccessUserToken: API.OperationMethod<
+  ListAccessUserTokenRequest,
+  ListAccessUserTokenResponse,
+  ListAccessUserTokenError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAccessUserTokenRequest,
+  output: ListAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginAccessOpenidError = ProxmoxOpError;
+/** Verify OpenID authorization code and create a ticket. (root-privileged endpoint) */
+export const loginAccessOpenid: API.OperationMethod<
+  LoginAccessOpenidRequest,
+  LoginAccessOpenidResponse,
+  LoginAccessOpenidError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginAccessOpenidRequest,
+  output: LoginAccessOpenidResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessAclError = ProxmoxOpError;
+/** Update Access Control List (add or remove permissions). (root-privileged endpoint) */
+export const putAccessAcl: API.OperationMethod<
+  PutAccessAclRequest,
+  PutAccessAclResponse,
+  PutAccessAclError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessAclRequest,
+  output: PutAccessAclResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessDomainError = ProxmoxOpError;
+/** Update authentication server settings. (root-privileged endpoint) */
+export const putAccessDomain: API.OperationMethod<
+  PutAccessDomainRequest,
+  PutAccessDomainResponse,
+  PutAccessDomainError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessDomainRequest,
+  output: PutAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessGroupError = ProxmoxOpError;
+/** Update group data. (root-privileged endpoint) */
+export const putAccessGroup: API.OperationMethod<
+  PutAccessGroupRequest,
+  PutAccessGroupResponse,
+  PutAccessGroupError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessGroupRequest,
+  output: PutAccessGroupResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessPasswordError = ProxmoxOpError;
+/** Change user password. (root-privileged endpoint) */
+export const putAccessPassword: API.OperationMethod<
+  PutAccessPasswordRequest,
+  PutAccessPasswordResponse,
+  PutAccessPasswordError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessPasswordRequest,
+  output: PutAccessPasswordResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessRoleError = ProxmoxOpError;
+/** Update an existing role. (root-privileged endpoint) */
+export const putAccessRole: API.OperationMethod<
+  PutAccessRoleRequest,
+  PutAccessRoleResponse,
+  PutAccessRoleError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessRoleRequest,
+  output: PutAccessRoleResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessTfaError = ProxmoxOpError;
+/** Add a TFA entry for a user. (root-privileged endpoint) */
+export const putAccessTfa: API.OperationMethod<
+  PutAccessTfaRequest,
+  PutAccessTfaResponse,
+  PutAccessTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessTfaRequest,
+  output: PutAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserError = ProxmoxOpError;
+/** Update user configuration. (root-privileged endpoint) */
+export const putAccessUser: API.OperationMethod<
+  PutAccessUserRequest,
+  PutAccessUserResponse,
+  PutAccessUserError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserRequest,
+  output: PutAccessUserResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserTokenError = ProxmoxOpError;
+/** Update API token for a specific user. NOTE: when 'regenerate' is set, the returned token value needs to be stored as it cannot be retrieved afterwards! (root-privileged endpoint) */
+export const putAccessUserToken: API.OperationMethod<
+  PutAccessUserTokenRequest,
+  PutAccessUserTokenResponse,
+  PutAccessUserTokenError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserTokenRequest,
+  output: PutAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutAccessUserUnlockTfaError = ProxmoxOpError;
+/** Unlock a user's TFA authentication. (root-privileged endpoint) */
+export const putAccessUserUnlockTfa: API.OperationMethod<
+  PutAccessUserUnlockTfaRequest,
+  PutAccessUserUnlockTfaResponse,
+  PutAccessUserUnlockTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutAccessUserUnlockTfaRequest,
+  output: PutAccessUserUnlockTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SyncAccessDomainError = ProxmoxOpError;
+/** Syncs users and/or groups from the configured LDAP to user.cfg. NOTE: Synced groups will have the name 'name-$realm', so make sure those groups do not exist to prevent overwriting. (root-privileged endpoint) */
+export const syncAccessDomain: API.OperationMethod<
+  SyncAccessDomainRequest,
+  SyncAccessDomainResponse,
+  SyncAccessDomainError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SyncAccessDomainRequest,
+  output: SyncAccessDomainResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateAccessTfaError = ProxmoxOpError;
+/** Add a TFA entry for a user. (root-privileged endpoint) */
+export const updateAccessTfa: API.OperationMethod<
+  UpdateAccessTfaRequest,
+  UpdateAccessTfaResponse,
+  UpdateAccessTfaError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateAccessTfaRequest,
+  output: UpdateAccessTfaResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateAccessUserTokenError = ProxmoxOpError;
+/** Generate a new API token for a specific user. NOTE: returns API token value, which needs to be stored as it cannot be retrieved afterwards! (root-privileged endpoint) */
+export const updateAccessUserToken: API.OperationMethod<
+  UpdateAccessUserTokenRequest,
+  UpdateAccessUserTokenResponse,
+  UpdateAccessUserTokenError,
+  ProxmoxOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateAccessUserTokenRequest,
+  output: UpdateAccessUserTokenResponse,
+  errors: [],
+  protocol: ProxmoxProtocol,
+  retry: Retry.Retry,
+}));