@iblai/iblai-api 4.432.0-core → 4.433.0-ai

package/dist/types/services/AiAccountService.d.ts

@@ -0,0 +1,1071 @@
+import type { AdminIntegrationCredential } from '../models/AdminIntegrationCredential';
+import type { ConnectedService } from '../models/ConnectedService';
+import type { CredentialRequest } from '../models/CredentialRequest';
+import type { FallbackLLM } from '../models/FallbackLLM';
+import type { FallbackLLMCreate } from '../models/FallbackLLMCreate';
+import type { FallbackLLMUpdate } from '../models/FallbackLLMUpdate';
+import type { IntegrationCredential } from '../models/IntegrationCredential';
+import type { IntegrationCredentialSchema } from '../models/IntegrationCredentialSchema';
+import type { LLMCredentialRequest } from '../models/LLMCredentialRequest';
+import type { LLMCredentialResponse } from '../models/LLMCredentialResponse';
+import type { LLMCredentialSchema } from '../models/LLMCredentialSchema';
+import type { MaskedIntegrationCredential } from '../models/MaskedIntegrationCredential';
+import type { MaskedLLMCredential } from '../models/MaskedLLMCredential';
+import type { OAuthProvider } from '../models/OAuthProvider';
+import type { OAuthService } from '../models/OAuthService';
+import type { OAuthStartResponse } from '../models/OAuthStartResponse';
+import type { PatchedCredentialRequest } from '../models/PatchedCredentialRequest';
+import type { PatchedFallbackLLMUpdate } from '../models/PatchedFallbackLLMUpdate';
+import type { PatchedLLMCredentialRequest } from '../models/PatchedLLMCredentialRequest';
+import type { PatchedTenantChatPrivacyConfig } from '../models/PatchedTenantChatPrivacyConfig';
+import type { TenantChatPrivacyConfig } from '../models/TenantChatPrivacyConfig';
+import type { TenantSetting } from '../models/TenantSetting';
+import type { UseMainCreds } from '../models/UseMainCreds';
+import type { UserChatPrivacySettings } from '../models/UserChatPrivacySettings';
+import type { CancelablePromise } from '../core/CancelablePromise';
+export declare class AiAccountService {
+    /**
+     * @returns ConnectedService Callback for the OAuth flow
+     * @throws ApiError
+     */
+    static aiAccountConnectedServicesCallbackRetrieve(): CancelablePromise<ConnectedService>;
+    /**
+     * Wires RBAC into a DRF view.
+     *
+     * Two responsibilities:
+     *
+     * 1. When RBAC is enabled, replace the view's `permission_classes` with
+     * `RbacAuthGate` (the gate the RBAC layer assumes — `IsEdxAuthenticated`
+     * semantics, plus opt-in acceptance of token-policies PlatformApiKeys for
+     * views that set `token_policies_enabled = True`).
+     *
+     * 2. Detect server-to-server (Django auth) callers via `is_service_account`.
+     * Server-to-server tokens authenticate as Django auth users with no
+     * relationship to a platform EdxUser. The convention is "we trust this
+     * caller — bypass RBAC and serve the request."
+     *
+     * Combine it with the RBAC-disabled check at the top of `initial()` so
+     * the early exit skips all RBAC prep work:
+     *
+     * if not ConfigFlags.rbac_enabled() or self.is_service_account:
+     * return
+     *
+     * Use `is_service_account` at any other touch points where caller
+     * identity matters (queryset ownership filters, owner attribution on
+     * create, serializer context, etc.).
+     * @returns ConnectedService
+     * @throws ApiError
+     */
+    static aiAccountConnectedServicesOrgsUsersList({ org, userId, ordering, provider, search, service, }: {
+        org: string; /**
+         * Which field to use when ordering the results.
+         */
+        ordering?: string;
+        provider?: string; /**
+         * A search term.
+         */
+        search?: string;
+        service?: string;
+    }): CancelablePromise<Array<ConnectedService>>;
+    /**
+     * Wires RBAC into a DRF view.
+     *
+     * Two responsibilities:
+     *
+     * 1. When RBAC is enabled, replace the view's `permission_classes` with
+     * `RbacAuthGate` (the gate the RBAC layer assumes — `IsEdxAuthenticated`
+     * semantics, plus opt-in acceptance of token-policies PlatformApiKeys for
+     * views that set `token_policies_enabled = True`).
+     *
+     * 2. Detect server-to-server (Django auth) callers via `is_service_account`.
+     * Server-to-server tokens authenticate as Django auth users with no
+     * relationship to a platform EdxUser. The convention is "we trust this
+     * caller — bypass RBAC and serve the request."
+     *
+     * Combine it with the RBAC-disabled check at the top of `initial()` so
+     * the early exit skips all RBAC prep work:
+     *
+     * if not ConfigFlags.rbac_enabled() or self.is_service_account:
+     * return
+     *
+     * Use `is_service_account` at any other touch points where caller
+     * identity matters (queryset ownership filters, owner attribution on
+     * create, serializer context, etc.).
+     * @returns ConnectedService
+     * @throws ApiError
+     */
+    static aiAccountConnectedServicesOrgsUsersRetrieve({ id, org, userId, }: {
+        /**
+         * A unique integer value identifying this connected service.
+         */
+        id: number;
+        org: string;
+    }): CancelablePromise<ConnectedService>;
+    /**
+     * Wires RBAC into a DRF view.
+     *
+     * Two responsibilities:
+     *
+     * 1. When RBAC is enabled, replace the view's `permission_classes` with
+     * `RbacAuthGate` (the gate the RBAC layer assumes — `IsEdxAuthenticated`
+     * semantics, plus opt-in acceptance of token-policies PlatformApiKeys for
+     * views that set `token_policies_enabled = True`).
+     *
+     * 2. Detect server-to-server (Django auth) callers via `is_service_account`.
+     * Server-to-server tokens authenticate as Django auth users with no
+     * relationship to a platform EdxUser. The convention is "we trust this
+     * caller — bypass RBAC and serve the request."
+     *
+     * Combine it with the RBAC-disabled check at the top of `initial()` so
+     * the early exit skips all RBAC prep work:
+     *
+     * if not ConfigFlags.rbac_enabled() or self.is_service_account:
+     * return
+     *
+     * Use `is_service_account` at any other touch points where caller
+     * identity matters (queryset ownership filters, owner attribution on
+     * create, serializer context, etc.).
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountConnectedServicesOrgsUsersDestroy({ id, org, userId, }: {
+        /**
+         * A unique integer value identifying this connected service.
+         */
+        id: number;
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Wires RBAC into a DRF view.
+     *
+     * Two responsibilities:
+     *
+     * 1. When RBAC is enabled, replace the view's `permission_classes` with
+     * `RbacAuthGate` (the gate the RBAC layer assumes — `IsEdxAuthenticated`
+     * semantics, plus opt-in acceptance of token-policies PlatformApiKeys for
+     * views that set `token_policies_enabled = True`).
+     *
+     * 2. Detect server-to-server (Django auth) callers via `is_service_account`.
+     * Server-to-server tokens authenticate as Django auth users with no
+     * relationship to a platform EdxUser. The convention is "we trust this
+     * caller — bypass RBAC and serve the request."
+     *
+     * Combine it with the RBAC-disabled check at the top of `initial()` so
+     * the early exit skips all RBAC prep work:
+     *
+     * if not ConfigFlags.rbac_enabled() or self.is_service_account:
+     * return
+     *
+     * Use `is_service_account` at any other touch points where caller
+     * identity matters (queryset ownership filters, owner attribution on
+     * create, serializer context, etc.).
+     * @returns OAuthStartResponse Starts the OAuth flow for the given provider and service
+     * @throws ApiError
+     */
+    static aiAccountConnectedServicesOrgsUsersRetrieve2({ org, provider, service, userId, loginHint, }: {
+        org: string;
+        provider: string;
+        service: string; /**
+         * Optional account hint passed to the provider's authorization request (OpenID Connect login_hint).
+         */
+        loginHint?: string;
+    }): CancelablePromise<OAuthStartResponse>;
+    /**
+     * Retrieve LLM credentials for an organization.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by LLM provider name.
+     * When name=google, returns both 'google' (service account) and
+     * 'gemini_google_api_key' credentials if they exist.
+     * unmask_sensitive_fields (optional, bool, default False):
+     * If true, returns the raw unmasked credential value. Restricted
+     * to credentials owned by the requested tenant — the
+     * ``GlobalCredential`` fallback is suppressed when unmasking,
+     * and the response is ``[]`` instead of 404 if the tenant has
+     * no own credentials.
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of LLM credentials for the organization. Values
+     * are masked by default; unmasked when ``unmask_sensitive_fields=true``
+     * and the credential belongs to the tenant.
+     *
+     * Raises:
+     * NotFound: When organization is not found, or (in default masked
+     * mode) when no credentials match the filters even after the
+     * global-credential fallback.
+     * ValidationError: When query parameters are invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsCredentialRetrieve({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Create a new LLM credential for an organization.
+     *
+     * For azure_openai credentials, if credential already exists, merges the new
+     * models with existing ones instead of replacing.
+     *
+     * Args:
+     * request: The HTTP request containing credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Created or updated LLM credential
+     *
+     * Raises:
+     * NotFound: When organization is not found
+     * ValidationError: When request data is invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsCredentialCreate({ org, requestBody, }: {
+        org: string;
+        requestBody: LLMCredentialRequest;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Update an existing LLM credential for an organization.
+     *
+     * For azure_openai credentials, supports partial model updates by deep merging
+     * the provided model fields with existing ones.
+     *
+     * Args:
+     * request: The HTTP request containing updated credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Updated LLM credential
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsCredentialPartialUpdate({ org, requestBody, }: {
+        org: string;
+        requestBody?: PatchedLLMCredentialRequest;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Delete an existing LLM credential for an organization.
+     *
+     * For azure_openai credentials, supports deleting a specific model by providing
+     * the 'model_name' field. If model_name is omitted, deletes the entire credential.
+     *
+     * Args:
+     * request: The HTTP request containing credential information (must include 'name')
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: 204
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsCredentialDestroy({ org, }: {
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Retrieve LLM credentials schemas.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by LLM service name
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of integration credentials schema available.
+     *
+     * Raises:
+     * NotFound: When  no credentials match the filters
+     * ValidationError: When query parameters are invalid
+     * @returns LLMCredentialSchema
+     * @throws ApiError
+     */
+    static aiAccountOrgsCredentialSchemaRetrieve({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<LLMCredentialSchema>;
+    /**
+     * List fallback LLM configurations
+     * List all fallback LLM configurations for the tenant and global configs.
+     * @returns FallbackLLM
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmList({ org, isEnabled, ordering, scope, }: {
+        org: string;
+        /**
+         * Filter by enabled status
+         */
+        isEnabled?: boolean;
+        /**
+         * Which field to use when ordering the results.
+         */
+        ordering?: string;
+        /**
+         * Filter by scope (model or provider)
+         */
+        scope?: string;
+    }): CancelablePromise<Array<FallbackLLM>>;
+    /**
+     * Create fallback LLM configuration
+     *
+     * Create a new fallback LLM configuration.
+     *
+     * - For model scope: specify source_model_name
+     * - For provider scope: only source_provider_name is needed
+     * - Leave tenant_key empty for global configuration
+     *
+     * @returns FallbackLLM
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmCreate({ org, requestBody, }: {
+        org: string;
+        requestBody: FallbackLLMCreate;
+    }): CancelablePromise<FallbackLLM>;
+    /**
+     * Get fallback LLM configuration
+     * Retrieve a specific fallback LLM configuration.
+     * @returns FallbackLLM
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmRetrieve({ id, org, }: {
+        id: string;
+        org: string;
+    }): CancelablePromise<FallbackLLM>;
+    /**
+     * Update fallback LLM configuration
+     * Update an existing fallback LLM configuration.
+     * @returns FallbackLLM
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmUpdate({ id, org, requestBody, }: {
+        id: string;
+        org: string;
+        requestBody: FallbackLLMUpdate;
+    }): CancelablePromise<FallbackLLM>;
+    /**
+     * Partially update fallback LLM configuration
+     * Partially update an existing fallback LLM configuration.
+     * @returns FallbackLLM
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmPartialUpdate({ id, org, requestBody, }: {
+        id: string;
+        org: string;
+        requestBody?: PatchedFallbackLLMUpdate;
+    }): CancelablePromise<FallbackLLM>;
+    /**
+     * Delete fallback LLM configuration
+     * Delete a fallback LLM configuration.
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsFallbackLlmDestroy({ id, org, }: {
+        id: string;
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Retrieve integration credentials for an organization.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by integration service name
+     * unmask_sensitive_fields (optional, bool, default False):
+     * If true and the requester is a platform admin for ``org``,
+     * returns full unmasked credential values. Restricted to
+     * credentials owned by the requested tenant — the ``main``
+     * platform fallback is suppressed when unmasking, so admins
+     * cannot read another tenant's or the global ``main``
+     * credentials unmasked. Silently ignored for non-admins;
+     * students never receive sensitive fields regardless of this
+     * flag.
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of integration credentials for the organization.
+     * The response shape differs by caller role:
+     * - Admins: every credential on the platform, with sensitive
+     * fields masked (``AdminIntegrationCredentialSerializer`` →
+     * ``IntegrationCredential.masked_value``).
+     * - Students: only credentials whose schema declares at least
+     * one non-sensitive field; sensitive fields are removed
+     * entirely from each value
+     * (``StudentIntegrationCredentialSerializer`` →
+     * ``IntegrationCredential.value``). Visibility is determined
+     * by ``IntegrationCredential.is_student_visible()`` — schema-
+     * driven, not a hardcoded provider list.
+     * If the tenant has no credentials of its own and
+     * ``ALLOW_TENANTS_TO_USE_MAIN_LLM_CREDENTIALS`` is enabled, the
+     * view falls back to ``platform__key="main"`` credentials,
+     * subject to the same role-based filtering.
+     *
+     * Raises:
+     * NotFound: When organization is not found or when no credentials match the filters
+     * ValidationError: When query parameters are invalid
+     * @returns AdminIntegrationCredential
+     * @throws ApiError
+     */
+    static aiAccountOrgsIntegrationCredentialList({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<Array<AdminIntegrationCredential>>;
+    /**
+     * Create a new integration credential for an organization.
+     *
+     * Args:
+     * request: The HTTP request containing credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Created integration credential
+     *
+     * Raises:
+     * NotFound: When organization is not found
+     * ValidationError: When request data is invalid
+     * @returns IntegrationCredential
+     * @throws ApiError
+     */
+    static aiAccountOrgsIntegrationCredentialCreate({ org, requestBody, }: {
+        org: string;
+        requestBody: CredentialRequest;
+    }): CancelablePromise<IntegrationCredential>;
+    /**
+     * Update an existing integration credential for an organization.
+     *
+     * Args:
+     * request: The HTTP request containing updated credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Updated integration credential
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns IntegrationCredential
+     * @throws ApiError
+     */
+    static aiAccountOrgsIntegrationCredentialPartialUpdate({ org, requestBody, }: {
+        org: string;
+        requestBody?: PatchedCredentialRequest;
+    }): CancelablePromise<IntegrationCredential>;
+    /**
+     * Delete an existing integration credential for an organization.
+     *
+     * Args:
+     * request: The HTTP request containing credential information (must include 'name')
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: 204
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsIntegrationCredentialDestroy({ org, }: {
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * @deprecated
+     * Retrieve integration credentials schema (deprecated v1 shape).
+     *
+     * Query Parameters:
+     * name (optional): Filter results by integration service name
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of integration credentials schema in v1 shape with
+     * ``Deprecation`` and ``Link`` headers pointing to the v2 endpoint.
+     * @returns IntegrationCredentialSchema
+     * @throws ApiError
+     */
+    static aiAccountOrgsIntegrationCredentialSchemaRetrieve({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<IntegrationCredentialSchema>;
+    /**
+     * Retrieve LLM credentials for an organization.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by LLM provider name.
+     * When name=google, returns both 'google' (service account) and
+     * 'gemini_google_api_key' credentials if they exist.
+     * unmask_sensitive_fields (optional, bool, default False):
+     * If true, returns the raw unmasked credential value. Restricted
+     * to credentials owned by the requested tenant — the
+     * ``GlobalCredential`` fallback is suppressed when unmasking,
+     * and the response is ``[]`` instead of 404 if the tenant has
+     * no own credentials.
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of LLM credentials for the organization. Values
+     * are masked by default; unmasked when ``unmask_sensitive_fields=true``
+     * and the credential belongs to the tenant.
+     *
+     * Raises:
+     * NotFound: When organization is not found, or (in default masked
+     * mode) when no credentials match the filters even after the
+     * global-credential fallback.
+     * ValidationError: When query parameters are invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsLlmCredentialRetrieve({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Create a new LLM credential for an organization.
+     *
+     * For azure_openai credentials, if credential already exists, merges the new
+     * models with existing ones instead of replacing.
+     *
+     * Args:
+     * request: The HTTP request containing credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Created or updated LLM credential
+     *
+     * Raises:
+     * NotFound: When organization is not found
+     * ValidationError: When request data is invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsLlmCredentialCreate({ org, requestBody, }: {
+        org: string;
+        requestBody: LLMCredentialRequest;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Update an existing LLM credential for an organization.
+     *
+     * For azure_openai credentials, supports partial model updates by deep merging
+     * the provided model fields with existing ones.
+     *
+     * Args:
+     * request: The HTTP request containing updated credential information
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Updated LLM credential
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns LLMCredentialResponse
+     * @throws ApiError
+     */
+    static aiAccountOrgsLlmCredentialPartialUpdate({ org, requestBody, }: {
+        org: string;
+        requestBody?: PatchedLLMCredentialRequest;
+    }): CancelablePromise<LLMCredentialResponse>;
+    /**
+     * Delete an existing LLM credential for an organization.
+     *
+     * For azure_openai credentials, supports deleting a specific model by providing
+     * the 'model_name' field. If model_name is omitted, deletes the entire credential.
+     *
+     * Args:
+     * request: The HTTP request containing credential information (must include 'name')
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: 204
+     *
+     * Raises:
+     * NotFound: When organization or credential is not found
+     * ValidationError: When request data is invalid
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsLlmCredentialDestroy({ org, }: {
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Retrieve masked integration credentials for an organization.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by integration service name
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of integration credentials for the organization
+     *
+     * Raises:
+     * NotFound: When organization is not found or when no credentials match the filters
+     * ValidationError: When query parameters are invalid
+     * @returns MaskedIntegrationCredential
+     * @throws ApiError
+     */
+    static aiAccountOrgsMaskedIntegrationCredentialList({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<Array<MaskedIntegrationCredential>>;
+    /**
+     * Retrieve LLM credentials for an organization with the value entries masked.
+     *
+     * Query Parameters:
+     * name (optional): Filter results by LLM provider name
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: List of LLM credentials for the organization
+     *
+     * Raises:
+     * NotFound: When organization is not found or when no credentials match the filters
+     * ValidationError: When query parameters are invalid
+     * @returns MaskedLLMCredential
+     * @throws ApiError
+     */
+    static aiAccountOrgsMaskedLlmCredentialRetrieve({ org, name, unmaskSensitiveFields, }: {
+        org: string;
+        /**
+         * Filter credentials by provider name (e.g., 'openai', 'google')
+         */
+        name?: string;
+        /**
+         * If true and the requester is a platform admin for the org, returns full unmasked credential values. Restricted to credentials owned by the requested tenant (no main-platform fallback when unmasking). Ignored for non-admins.
+         */
+        unmaskSensitiveFields?: boolean;
+    }): CancelablePromise<MaskedLLMCredential>;
+    /**
+     * Return the list of OAuth services that can be used for connected services.
+     *
+     * Query Parameters:
+     * name (optional): Filter by exact service name (case-insensitive).
+     * include_disabled (optional): Set to `true` to include disabled services.
+     * @returns OAuthProvider
+     * @throws ApiError
+     */
+    static aiAccountOrgsOauthServicesList({ org, }: {
+        org: string;
+    }): CancelablePromise<Array<OAuthProvider>>;
+    /**
+     * Return the available scopes for the specified OAuth service.
+     *
+     * Query Parameters:
+     * include_disabled (optional): Set to `true` to include scopes from disabled services.
+     * @returns OAuthService
+     * @throws ApiError
+     */
+    static aiAccountOrgsOauthServicesScopesList({ org, serviceName, }: {
+        org: string;
+        serviceName: string;
+    }): CancelablePromise<Array<OAuthService>>;
+    /**
+     * Enable or disable the use of main LLM credentials for an organization.
+     *
+     * Request Body:
+     * enable (boolean): Set to true to enable main credentials
+     * disable (boolean): Set to true to disable main credentials
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Confirmation message
+     *
+     * Raises:
+     * ValidationError: When neither enable nor disable is specified
+     * @returns any
+     * @throws ApiError
+     */
+    static aiAccountOrgsUseDefaultLlmKeyCreate({ org, requestBody, }: {
+        org: string;
+        requestBody: UseMainCreds;
+    }): CancelablePromise<{
+        message?: string;
+    }>;
+    /**
+     * Enable, disable, or update free trial settings for an organization.
+     *
+     * Request Body:
+     * enable (boolean): Set to true to enable free trial
+     * disable (boolean): Set to true to disable free trial
+     * metadata (object, optional): Additional metadata for the free trial
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Confirmation message
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsUseFreeTrialCreate({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Return whether the tenant allows user-controlled chat privacy.
+     * @returns TenantChatPrivacyConfig Tenant chat-privacy configuration
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersChatPrivacyConfigRetrieve({ org, userId, }: {
+        org: string;
+    }): CancelablePromise<TenantChatPrivacyConfig>;
+    /**
+     * Flip `ALLOW_USER_CHAT_PRIVACY_CONTROL` for the tenant. Admins only.
+     * @returns TenantChatPrivacyConfig Updated tenant chat-privacy configuration
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersChatPrivacyConfigPartialUpdate({ org, userId, requestBody, }: {
+        org: string;
+        requestBody?: PatchedTenantChatPrivacyConfig;
+    }): CancelablePromise<TenantChatPrivacyConfig>;
+    /**
+     * Get the effective chat-privacy mode for the given (tenant, mentor,
+     * user, session) tuple.
+     *
+     * Args:
+     * request: HTTP request. Query params: `mentor` (unique_id, slug, or
+     * name — unique_id tried first), `session` (uuid).
+     * org: Platform key.
+     * user_id: Username of the user whose effective mode is being resolved.
+     * @returns any Effective chat privacy mode and source tier
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersChatPrivacyEffectiveRetrieve({ org, userId, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Get user's global chat privacy settings.
+     *
+     * Returns the user's current chat privacy mode if the feature is enabled
+     * for the platform, otherwise indicates the feature is disabled.
+     * @returns any User chat privacy settings
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersChatPrivacySettingsRetrieve({ org, userId, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Update user's global chat privacy settings.
+     *
+     * Allows users to set their chat privacy preference (normal, anonymized, or disabled)
+     * if the platform has enabled the ALLOW_USER_CHAT_PRIVACY_CONTROL setting.
+     * @returns any Updated chat privacy settings
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersChatPrivacySettingsCreate({ org, userId, requestBody, }: {
+        org: string;
+        requestBody?: UserChatPrivacySettings;
+    }): CancelablePromise<any>;
+    /**
+     * Retrieve the status of main LLM credential usage for an organization.
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     * user_id: User identifier
+     *
+     * Returns:
+     * Response: Status of main LLM credential usage
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersDefaultLlmKeyUsageRetrieve({ org, userId, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Retrieve the free trial status for an organization.
+     *
+     * Args:
+     * request: The HTTP request
+     * org: Organization key identifier
+     *
+     * Returns:
+     * Response: Free trial status (boolean)
+     *
+     * Raises:
+     * NotFound: When organization is not found
+     * @returns any
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersFreeTrialRetrieve({ org, userId, }: {
+        org: string;
+    }): CancelablePromise<{
+        is_in_free_trial?: boolean;
+    }>;
+    /**
+     * Get a platform's settings
+     *
+     * Example response:
+     * ```
+     * {"teams_bot_mentor": "f2116cf2-95c7-4c1f-b19e-666ad529439f"}
+     *
+     * ```
+     * @returns TenantSetting
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersTenantSettingsRetrieve({ org, userId, }: {
+        org: string;
+        userId: string;
+    }): CancelablePromise<TenantSetting>;
+    /**
+     * Example Request:
+     *
+     * ```
+     * {"teams_bot_mentor": "f2116cf2-95c7-4c1f-b19e-666ad529439f"}
+     * ```
+     * The value here is the mentor's unique id
+     * @returns TenantSetting
+     * @throws ApiError
+     */
+    static aiAccountOrgsUsersTenantSettingsCreate({ org, userId, requestBody, }: {
+        org: string;
+        requestBody?: TenantSetting;
+    }): CancelablePromise<TenantSetting>;
+    /**
+     * Named egress allowlists a tenant admin reuses across mentors.
+     *
+     * A policy is platform-scoped and bound to a mentor through the settings
+     * endpoint (``virtual_machine_network_policy_id`` under
+     * ``virtual_machine_egress='custom'``). The hosts are sent to the sandbox
+     * inline on each session create; the control plane holds no copy.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/list``
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/delete``
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineNetworkPolicyRetrieve({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Named egress allowlists a tenant admin reuses across mentors.
+     *
+     * A policy is platform-scoped and bound to a mentor through the settings
+     * endpoint (``virtual_machine_network_policy_id`` under
+     * ``virtual_machine_egress='custom'``). The hosts are sent to the sandbox
+     * inline on each session create; the control plane holds no copy.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/list``
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/delete``
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineNetworkPolicyCreate({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Named egress allowlists a tenant admin reuses across mentors.
+     *
+     * A policy is platform-scoped and bound to a mentor through the settings
+     * endpoint (``virtual_machine_network_policy_id`` under
+     * ``virtual_machine_egress='custom'``). The hosts are sent to the sandbox
+     * inline on each session create; the control plane holds no copy.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/list``
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/delete``
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineNetworkPolicyPartialUpdate({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Named egress allowlists a tenant admin reuses across mentors.
+     *
+     * A policy is platform-scoped and bound to a mentor through the settings
+     * endpoint (``virtual_machine_network_policy_id`` under
+     * ``virtual_machine_egress='custom'``). The hosts are sent to the sandbox
+     * inline on each session create; the control plane holds no copy.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/list``
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineNetworkPolicies/delete``
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineNetworkPolicyDestroy({ org, }: {
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Manage the credentials a mentor's VM may use without being able to read them.
+     *
+     * The value is write-only in the strongest sense: it is accepted on create and
+     * update and is returned by nothing. There is deliberately no unmask action to
+     * grant — unlike ``IntegrationCredentialAPIView`` there is no read capability
+     * at all, so there is none to gate.
+     *
+     * ``token_policies_enabled`` stays off for the same reason: the whole premise
+     * is that no token, anywhere, can fetch these. Only DM resolves them, and only
+     * server-side, straight onto the sandbox session-create call.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineSecrets/list``   — read the configured set
+     * - ``Ibl.Mentor/VirtualMachineSecrets/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineSecrets/delete`` — delete
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineSecretRetrieve({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Manage the credentials a mentor's VM may use without being able to read them.
+     *
+     * The value is write-only in the strongest sense: it is accepted on create and
+     * update and is returned by nothing. There is deliberately no unmask action to
+     * grant — unlike ``IntegrationCredentialAPIView`` there is no read capability
+     * at all, so there is none to gate.
+     *
+     * ``token_policies_enabled`` stays off for the same reason: the whole premise
+     * is that no token, anywhere, can fetch these. Only DM resolves them, and only
+     * server-side, straight onto the sandbox session-create call.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineSecrets/list``   — read the configured set
+     * - ``Ibl.Mentor/VirtualMachineSecrets/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineSecrets/delete`` — delete
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineSecretCreate({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Manage the credentials a mentor's VM may use without being able to read them.
+     *
+     * The value is write-only in the strongest sense: it is accepted on create and
+     * update and is returned by nothing. There is deliberately no unmask action to
+     * grant — unlike ``IntegrationCredentialAPIView`` there is no read capability
+     * at all, so there is none to gate.
+     *
+     * ``token_policies_enabled`` stays off for the same reason: the whole premise
+     * is that no token, anywhere, can fetch these. Only DM resolves them, and only
+     * server-side, straight onto the sandbox session-create call.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineSecrets/list``   — read the configured set
+     * - ``Ibl.Mentor/VirtualMachineSecrets/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineSecrets/delete`` — delete
+     * @returns any No response body
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineSecretPartialUpdate({ org, }: {
+        org: string;
+    }): CancelablePromise<any>;
+    /**
+     * Manage the credentials a mentor's VM may use without being able to read them.
+     *
+     * The value is write-only in the strongest sense: it is accepted on create and
+     * update and is returned by nothing. There is deliberately no unmask action to
+     * grant — unlike ``IntegrationCredentialAPIView`` there is no read capability
+     * at all, so there is none to gate.
+     *
+     * ``token_policies_enabled`` stays off for the same reason: the whole premise
+     * is that no token, anywhere, can fetch these. Only DM resolves them, and only
+     * server-side, straight onto the sandbox session-create call.
+     *
+     * RBAC:
+     * - ``Ibl.Mentor/VirtualMachineSecrets/list``   — read the configured set
+     * - ``Ibl.Mentor/VirtualMachineSecrets/write``  — create/update
+     * - ``Ibl.Mentor/VirtualMachineSecrets/delete`` — delete
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountOrgsVirtualMachineSecretDestroy({ org, }: {
+        org: string;
+    }): CancelablePromise<void>;
+    /**
+     * Stripe Connect OAuth callback
+     * Stripe's OAuth return.
+     *
+     * Unauthenticated by design — the browser arrives from Stripe with no token
+     * (the Google connector's callback works the same way); identity, platform
+     * and where to send the browser next all come from the single-use state (a DB
+     * row, or a cache entry before migration 0373) minted by
+     * ``StripeConnectView.post``. Nothing here trusts the query beyond that state,
+     * and the code is exchanged at most once.
+     * @returns void
+     * @throws ApiError
+     */
+    static aiAccountStripeConnectCallback({ state, code, error, errorDescription, }: {
+        state: string;
+        code?: string;
+        error?: string;
+        errorDescription?: string;
+    }): CancelablePromise<void>;
+}