@hyper.authio/admin 0.7.0 → 0.8.1

package/dist/index.d.cts

@@ -3,7 +3,7 @@ import { AuthioAccountCredential, AuthioAccountCredentialOptions } from '@hyper.
 export { AuthioAdminError, AuthioAdminNotification, AuthioConfigurationError, parseAuthioAdminEnvelope } from '@hyper.authio/client';
 
 /**
- * Generated by scripts/generate.mjs from openapi/v1.json (authio.api 9bbf9c5f753ef4bb8949160baa292021080e089f).
+ * Generated by scripts/generate.mjs from openapi/v1.json (authio.api a69a97617839b76bd36ee0a6b7b1e80397205fd7).
  * Do not edit: run `npm run generate -w @hyper.authio/admin`.
  */
 interface paths {
@@ -262,7 +262,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Reports whether the account has an authenticator paired and two-factor sign-in required. */
+        /** Reports whether the account has an authenticator app in force, and how many recovery codes it has left. */
         get: operations["Totp_GetStatus"];
         put?: never;
         post?: never;
@@ -284,7 +284,8 @@ interface paths {
         /**
          * Starts enrolment by issuing a fresh key for an authenticator application.
          * @description Two-factor sign-in is not enabled here: the key only takes effect once a valid code proves the
-         *         pairing works, which is what keeps a mistyped key from locking the account out at the next sign-in.
+         *         pairing works, which is what keeps a mistyped key from locking the account out at the next sign-in. Refused
+         *         with a conflict while an app is in force, because issuing a key would stop the codes that app shows.
          */
         post: operations["Totp_StartEnrollment"];
         delete?: never;
@@ -895,6 +896,24 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/admin/users/{userId}/mfa/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Reports whether a user has an authenticator app in force and how many recovery codes they have left. */
+        get: operations["UserTotp_GetStatus"];
+        put?: never;
+        post?: never;
+        /** Resets a user's authenticator app: the secret and the recovery codes are discarded. */
+        delete: operations["UserTotp_Reset"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/admin/threat-incidents/{incidentId}/analyses": {
         parameters: {
             query?: never;
@@ -10529,10 +10548,20 @@ interface components {
             signEncryptedTokens?: boolean;
             /** @description Gets or sets the type of cryptographic operation to be performed. */
             cryptographyType?: components["schemas"]["CryptographyType"];
-            /** @description Jws token algorithm type. */
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
-            /** @description Gets or sets the algorithm used for managing digital subscriptions. */
-            digitalSubscriptionsAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets the algorithm family the ID token, the signed UserInfo response and the logout token are signed
+             *     with.
+             */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
+            /** @description Gets or sets the algorithm the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /** @description Gets or sets the algorithm access tokens are signed with. */
+            accessTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets whether the client's access tokens can only be verified by introspection where resource servers
+             *     read them.
+             */
+            accessTokenRequiresIntrospection?: boolean;
             /** @description Jwe token algorithm type. */
             algorithmJweType?: components["schemas"]["AlgorithmType"];
             /** @description Gets or sets the encryption algorithm used for securing content. */
@@ -11041,8 +11070,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Indicates whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Indicates whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Indicates whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
         };
@@ -11109,8 +11136,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Indicates whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Indicates whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Indicates whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
         };
@@ -15355,12 +15380,14 @@ interface components {
         TokenConfigurationRequest: {
             encrypted?: boolean;
             cryptographyType?: components["schemas"]["CryptographyType"];
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
+            /** @description The algorithm family the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
             algorithmJweType?: components["schemas"]["AlgorithmType"];
-            digitalSubscriptionsAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            idTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
             jsonWebKeyECTypes?: null | components["schemas"]["JsonWebKeyCurveType"];
             encryptionAlgorithmKey?: null | components["schemas"]["EncryptionAlgorithmKeyType"];
             encryptionAlgorithmContent?: null | components["schemas"]["EncryptionAlgorithmContentType"];
+            accessTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
         };
         /** @description The verification code proving control of the paired authenticator. */
         TotpCodeRequest: {
@@ -15637,10 +15664,14 @@ interface components {
             encrypted?: boolean;
             /** @description Gets or sets the type of cryptographic operation to be performed. */
             cryptographyType?: components["schemas"]["CryptographyType"];
-            /** @description Jws token algorithm type. */
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
-            /** @description Gets or sets the algorithm used for managing digital subscriptions. */
-            digitalSubscriptionsAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets the algorithm family the ID token, the signed UserInfo response and the logout token are signed
+             *     with.
+             */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
+            /** @description Gets or sets the algorithm the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            accessTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
             /** @description Jwe token algorithm type. */
             algorithmJweType?: components["schemas"]["AlgorithmType"];
             /** @description Gets or sets the JSON Web Key (JWK) Elliptic Curve types supported by the application. */
@@ -15985,8 +16016,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Gets or sets a value indicating whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Gets or sets a value indicating whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Gets or sets a value indicating whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
             /** @description Gets or sets the list of role names that should be assigned to the user. */
@@ -17911,7 +17940,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description An IActionResult containing the shared key and the URI to pair with. */
+            /** @description OK */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -17920,6 +17949,15 @@ interface operations {
                     "application/json": components["schemas"]["ApiResultOfTotpSetupResponse"];
                 };
             };
+            /** @description Conflict */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
         };
     };
     Totp_Enable: {
@@ -17956,6 +17994,15 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResult"];
                 };
             };
+            /** @description Locked */
+            423: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
         };
     };
     Totp_Disable: {
@@ -19227,6 +19274,79 @@ interface operations {
             };
         };
     };
+    UserTotp_GetStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The user. */
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResultOfTotpStatusResponse"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+        };
+    };
+    UserTotp_Reset: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The user. */
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResultOfObject"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+            /** @description Conflict */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+        };
+    };
     ThreatAnalysis_GetAll: {
         parameters: {
             query?: never;
@@ -33972,16 +34092,16 @@ type AuthioAdminResult<Id extends AuthioAdminOperationId, Kind extends AuthioAdm
 type AuthioAdminMethod<Id extends AuthioAdminOperationId, Kind extends AuthioAdminResultKind> = {} extends AuthioAdminParams<Id> ? (params?: AuthioAdminParams<Id>, options?: AuthioAdminCallOptions) => Promise<AuthioAdminResult<Id, Kind>> : (params: AuthioAdminParams<Id>, options?: AuthioAdminCallOptions) => Promise<AuthioAdminResult<Id, Kind>>;
 
 /**
- * Generated by scripts/generate.mjs from openapi/v1.json (authio.api 9bbf9c5f753ef4bb8949160baa292021080e089f).
+ * Generated by scripts/generate.mjs from openapi/v1.json (authio.api a69a97617839b76bd36ee0a6b7b1e80397205fd7).
  * Do not edit: run `npm run generate -w @hyper.authio/admin`.
  */
 
 /**
  * The commit of authio.api whose OpenAPI document these operations were generated from.
  */
-declare const authioAdminOpenApiCommit = "9bbf9c5f753ef4bb8949160baa292021080e089f";
+declare const authioAdminOpenApiCommit = "a69a97617839b76bd36ee0a6b7b1e80397205fd7";
 /**
- * Every Admin API operation (359), grouped by the controller its `operationId` names: `Realm_GetAllPaginated` is
+ * Every Admin API operation (361), grouped by the controller its `operationId` names: `Realm_GetAllPaginated` is
  * `realm.getAllPaginated`.
  */
 interface AuthioAdminAreas {
@@ -35996,7 +36116,7 @@ interface AuthioAdminAreas {
     /** Admin - Two-Factor */
     readonly totp: {
         /**
-         * Reports whether the account has an authenticator paired and two-factor sign-in required.
+         * Reports whether the account has an authenticator app in force, and how many recovery codes it has left.
          *
          * `GET /api/v1/admin/users/me/mfa/totp` (`Totp_GetStatus`)
          */
@@ -36247,6 +36367,21 @@ interface AuthioAdminAreas {
          */
         readonly getOverview: AuthioAdminMethod<"UserSuspensionOverview_GetOverview", "data">;
     };
+    /** Admin - User Two-Factor */
+    readonly userTotp: {
+        /**
+         * Reports whether a user has an authenticator app in force and how many recovery codes they have left.
+         *
+         * `GET /api/v1/admin/users/{userId}/mfa/totp` (`UserTotp_GetStatus`)
+         */
+        readonly getStatus: AuthioAdminMethod<"UserTotp_GetStatus", "data">;
+        /**
+         * Resets a user's authenticator app: the secret and the recovery codes are discarded.
+         *
+         * `DELETE /api/v1/admin/users/{userId}/mfa/totp` (`UserTotp_Reset`)
+         */
+        readonly reset: AuthioAdminMethod<"UserTotp_Reset", "data">;
+    };
     /** Admin - Client Webhooks */
     readonly webhook: {
         /**
@@ -39586,6 +39721,26 @@ declare const authioAdminOperations: {
             readonly body: "none";
         };
     };
+    readonly userTotp: {
+        readonly getStatus: {
+            readonly id: "UserTotp_GetStatus";
+            readonly method: "GET";
+            readonly path: "/api/v1/admin/users/{userId}/mfa/totp";
+            readonly result: "data";
+            readonly pathParams: readonly ["userId"];
+            readonly queryParams: readonly [];
+            readonly body: "none";
+        };
+        readonly reset: {
+            readonly id: "UserTotp_Reset";
+            readonly method: "DELETE";
+            readonly path: "/api/v1/admin/users/{userId}/mfa/totp";
+            readonly result: "data";
+            readonly pathParams: readonly ["userId"];
+            readonly queryParams: readonly [];
+            readonly body: "none";
+        };
+    };
     readonly webhook: {
         readonly getAll: {
             readonly id: "Webhook_GetAll";

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { AuthioAccountCredential, AuthioAccountCredentialOptions } from '@hyper.
 export { AuthioAdminError, AuthioAdminNotification, AuthioConfigurationError, parseAuthioAdminEnvelope } from '@hyper.authio/client';
 
 /**
- * Generated by scripts/generate.mjs from openapi/v1.json (authio.api 9bbf9c5f753ef4bb8949160baa292021080e089f).
+ * Generated by scripts/generate.mjs from openapi/v1.json (authio.api a69a97617839b76bd36ee0a6b7b1e80397205fd7).
  * Do not edit: run `npm run generate -w @hyper.authio/admin`.
  */
 interface paths {
@@ -262,7 +262,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Reports whether the account has an authenticator paired and two-factor sign-in required. */
+        /** Reports whether the account has an authenticator app in force, and how many recovery codes it has left. */
         get: operations["Totp_GetStatus"];
         put?: never;
         post?: never;
@@ -284,7 +284,8 @@ interface paths {
         /**
          * Starts enrolment by issuing a fresh key for an authenticator application.
          * @description Two-factor sign-in is not enabled here: the key only takes effect once a valid code proves the
-         *         pairing works, which is what keeps a mistyped key from locking the account out at the next sign-in.
+         *         pairing works, which is what keeps a mistyped key from locking the account out at the next sign-in. Refused
+         *         with a conflict while an app is in force, because issuing a key would stop the codes that app shows.
          */
         post: operations["Totp_StartEnrollment"];
         delete?: never;
@@ -895,6 +896,24 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/admin/users/{userId}/mfa/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Reports whether a user has an authenticator app in force and how many recovery codes they have left. */
+        get: operations["UserTotp_GetStatus"];
+        put?: never;
+        post?: never;
+        /** Resets a user's authenticator app: the secret and the recovery codes are discarded. */
+        delete: operations["UserTotp_Reset"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/admin/threat-incidents/{incidentId}/analyses": {
         parameters: {
             query?: never;
@@ -10529,10 +10548,20 @@ interface components {
             signEncryptedTokens?: boolean;
             /** @description Gets or sets the type of cryptographic operation to be performed. */
             cryptographyType?: components["schemas"]["CryptographyType"];
-            /** @description Jws token algorithm type. */
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
-            /** @description Gets or sets the algorithm used for managing digital subscriptions. */
-            digitalSubscriptionsAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets the algorithm family the ID token, the signed UserInfo response and the logout token are signed
+             *     with.
+             */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
+            /** @description Gets or sets the algorithm the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /** @description Gets or sets the algorithm access tokens are signed with. */
+            accessTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets whether the client's access tokens can only be verified by introspection where resource servers
+             *     read them.
+             */
+            accessTokenRequiresIntrospection?: boolean;
             /** @description Jwe token algorithm type. */
             algorithmJweType?: components["schemas"]["AlgorithmType"];
             /** @description Gets or sets the encryption algorithm used for securing content. */
@@ -11041,8 +11070,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Indicates whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Indicates whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Indicates whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
         };
@@ -11109,8 +11136,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Indicates whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Indicates whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Indicates whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
         };
@@ -15355,12 +15380,14 @@ interface components {
         TokenConfigurationRequest: {
             encrypted?: boolean;
             cryptographyType?: components["schemas"]["CryptographyType"];
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
+            /** @description The algorithm family the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
             algorithmJweType?: components["schemas"]["AlgorithmType"];
-            digitalSubscriptionsAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            idTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
             jsonWebKeyECTypes?: null | components["schemas"]["JsonWebKeyCurveType"];
             encryptionAlgorithmKey?: null | components["schemas"]["EncryptionAlgorithmKeyType"];
             encryptionAlgorithmContent?: null | components["schemas"]["EncryptionAlgorithmContentType"];
+            accessTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
         };
         /** @description The verification code proving control of the paired authenticator. */
         TotpCodeRequest: {
@@ -15637,10 +15664,14 @@ interface components {
             encrypted?: boolean;
             /** @description Gets or sets the type of cryptographic operation to be performed. */
             cryptographyType?: components["schemas"]["CryptographyType"];
-            /** @description Jws token algorithm type. */
-            algorithmJwsType?: components["schemas"]["AlgorithmType"];
-            /** @description Gets or sets the algorithm used for managing digital subscriptions. */
-            digitalSubscriptionsAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            /**
+             * @description Gets or sets the algorithm family the ID token, the signed UserInfo response and the logout token are signed
+             *     with.
+             */
+            idTokenSigningAlgorithmType?: components["schemas"]["AlgorithmType"];
+            /** @description Gets or sets the algorithm the ID token, the signed UserInfo response and the logout token are signed with. */
+            idTokenSigningAlgorithm?: components["schemas"]["DigitalSubscriptionsAlgorithmType"];
+            accessTokenSigningAlgorithm?: null | components["schemas"]["DigitalSubscriptionsAlgorithmType"];
             /** @description Jwe token algorithm type. */
             algorithmJweType?: components["schemas"]["AlgorithmType"];
             /** @description Gets or sets the JSON Web Key (JWK) Elliptic Curve types supported by the application. */
@@ -15985,8 +16016,6 @@ interface components {
             emailConfirmed?: boolean;
             /** @description Gets or sets a value indicating whether the user's phone number has been confirmed. */
             phoneNumberConfirmed?: boolean;
-            /** @description Gets or sets a value indicating whether two-factor authentication is enabled for the user. */
-            twoFactorEnabled?: boolean;
             /** @description Gets or sets a value indicating whether account lockout is enabled for the user. */
             lockoutEnabled?: boolean;
             /** @description Gets or sets the list of role names that should be assigned to the user. */
@@ -17911,7 +17940,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description An IActionResult containing the shared key and the URI to pair with. */
+            /** @description OK */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -17920,6 +17949,15 @@ interface operations {
                     "application/json": components["schemas"]["ApiResultOfTotpSetupResponse"];
                 };
             };
+            /** @description Conflict */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
         };
     };
     Totp_Enable: {
@@ -17956,6 +17994,15 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResult"];
                 };
             };
+            /** @description Locked */
+            423: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
         };
     };
     Totp_Disable: {
@@ -19227,6 +19274,79 @@ interface operations {
             };
         };
     };
+    UserTotp_GetStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The user. */
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResultOfTotpStatusResponse"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+        };
+    };
+    UserTotp_Reset: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The user. */
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResultOfObject"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+            /** @description Conflict */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResult"];
+                };
+            };
+        };
+    };
     ThreatAnalysis_GetAll: {
         parameters: {
             query?: never;
@@ -33972,16 +34092,16 @@ type AuthioAdminResult<Id extends AuthioAdminOperationId, Kind extends AuthioAdm
 type AuthioAdminMethod<Id extends AuthioAdminOperationId, Kind extends AuthioAdminResultKind> = {} extends AuthioAdminParams<Id> ? (params?: AuthioAdminParams<Id>, options?: AuthioAdminCallOptions) => Promise<AuthioAdminResult<Id, Kind>> : (params: AuthioAdminParams<Id>, options?: AuthioAdminCallOptions) => Promise<AuthioAdminResult<Id, Kind>>;
 
 /**
- * Generated by scripts/generate.mjs from openapi/v1.json (authio.api 9bbf9c5f753ef4bb8949160baa292021080e089f).
+ * Generated by scripts/generate.mjs from openapi/v1.json (authio.api a69a97617839b76bd36ee0a6b7b1e80397205fd7).
  * Do not edit: run `npm run generate -w @hyper.authio/admin`.
  */
 
 /**
  * The commit of authio.api whose OpenAPI document these operations were generated from.
  */
-declare const authioAdminOpenApiCommit = "9bbf9c5f753ef4bb8949160baa292021080e089f";
+declare const authioAdminOpenApiCommit = "a69a97617839b76bd36ee0a6b7b1e80397205fd7";
 /**
- * Every Admin API operation (359), grouped by the controller its `operationId` names: `Realm_GetAllPaginated` is
+ * Every Admin API operation (361), grouped by the controller its `operationId` names: `Realm_GetAllPaginated` is
  * `realm.getAllPaginated`.
  */
 interface AuthioAdminAreas {
@@ -35996,7 +36116,7 @@ interface AuthioAdminAreas {
     /** Admin - Two-Factor */
     readonly totp: {
         /**
-         * Reports whether the account has an authenticator paired and two-factor sign-in required.
+         * Reports whether the account has an authenticator app in force, and how many recovery codes it has left.
          *
          * `GET /api/v1/admin/users/me/mfa/totp` (`Totp_GetStatus`)
          */
@@ -36247,6 +36367,21 @@ interface AuthioAdminAreas {
          */
         readonly getOverview: AuthioAdminMethod<"UserSuspensionOverview_GetOverview", "data">;
     };
+    /** Admin - User Two-Factor */
+    readonly userTotp: {
+        /**
+         * Reports whether a user has an authenticator app in force and how many recovery codes they have left.
+         *
+         * `GET /api/v1/admin/users/{userId}/mfa/totp` (`UserTotp_GetStatus`)
+         */
+        readonly getStatus: AuthioAdminMethod<"UserTotp_GetStatus", "data">;
+        /**
+         * Resets a user's authenticator app: the secret and the recovery codes are discarded.
+         *
+         * `DELETE /api/v1/admin/users/{userId}/mfa/totp` (`UserTotp_Reset`)
+         */
+        readonly reset: AuthioAdminMethod<"UserTotp_Reset", "data">;
+    };
     /** Admin - Client Webhooks */
     readonly webhook: {
         /**
@@ -39586,6 +39721,26 @@ declare const authioAdminOperations: {
             readonly body: "none";
         };
     };
+    readonly userTotp: {
+        readonly getStatus: {
+            readonly id: "UserTotp_GetStatus";
+            readonly method: "GET";
+            readonly path: "/api/v1/admin/users/{userId}/mfa/totp";
+            readonly result: "data";
+            readonly pathParams: readonly ["userId"];
+            readonly queryParams: readonly [];
+            readonly body: "none";
+        };
+        readonly reset: {
+            readonly id: "UserTotp_Reset";
+            readonly method: "DELETE";
+            readonly path: "/api/v1/admin/users/{userId}/mfa/totp";
+            readonly result: "data";
+            readonly pathParams: readonly ["userId"];
+            readonly queryParams: readonly [];
+            readonly body: "none";
+        };
+    };
     readonly webhook: {
         readonly getAll: {
             readonly id: "Webhook_GetAll";