@insurance-broker/api-client 5.20.0 → 5.21.0

package/dist/schema.d.ts

@@ -3052,6 +3052,69 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/customer-verification-methods": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The ways this broker's staff may verify a customer before signing them out, in the broker's order.
+         * @description The broker's closed set of verification methods (ADR-0049). A member of staff signing a customer out of every session picks one of these keys and the choice is recorded in the audit entry. The set is configuration, never empty once configured; an empty list means this broker has not configured one yet, and staff-assisted sign-out is refused until it does.
+         */
+        get: operations["ListCustomerVerificationMethods"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/customers/{id}/sessions/revocation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Signs a customer out of every session they have established, after a member of staff has verified them.
+         * @description **Every sign-in this customer established up to now stops working against this API on its next request** — the same effect as the customer's own `POST /api/v1/customer-account/sessions/revocation`, for a customer who rings in because a device was lost or stolen (SEC-012). The customer signs in again afterwards on the device they hold.
+         *
+         *     **Verify the customer first, then say how.** `verificationMethod` is a key from `GET /api/v1/customer-verification-methods`, this broker's closed set; `reason` is required, at most 500 characters, and is recorded with the method and the member of staff in the audit entry on the customer record (action `crm.customer.sessions-revoked-by-staff`). Tell the customer to change their password and secure their email account: signing out does not stop somebody who knows the password.
+         *
+         *     **Refusals.** `400` when either field is missing or the reason is too long. `404` when the customer is not this broker's. `409` with problem type `urn:brokerplatform:problem:verification-method-not-offered` when the method is not in this broker's set (or the broker has configured none) — read the set and choose from it. `409` with no type when the customer has never attached a sign-in account, so has no session to end.
+         *
+         *     **What it does not do yet.** It does not end the sessions at the identity provider or list them; those need the isolated identity-management component ADR-0049 describes.
+         */
+        post: operations["RevokeCustomerSessions"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/customer/contexts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** The parties the signed-in customer may act as: themselves, and every organisation they hold an active membership of. The identifier of each is what X-Broker-Acting-For takes. */
+        get: operations["ListActingContexts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organisations": {
         parameters: {
             query?: never;
@@ -3190,23 +3253,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/v1/customer/contexts": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** The parties the signed-in customer may act as: themselves, and every organisation they hold an active membership of. The identifier of each is what X-Broker-Acting-For takes. */
-        get: operations["ListActingContexts"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/v1/customer/organisations/{id}/membership/acceptance": {
         parameters: {
             query?: never;
@@ -7301,6 +7347,11 @@ export interface components {
             help: null | string;
             section: null | string;
         };
+        CustomerVerificationMethodResponse: {
+            key: string;
+            name: string;
+            description: null | string;
+        };
         DataClassificationResponse: {
             key: string;
             name: string;
@@ -9589,6 +9640,17 @@ export interface components {
             /** Format: uuid */
             conflictingPaymentId: string;
         };
+        StaffCustomerSessionRevocationRequest: {
+            verificationMethod: null | string;
+            reason: null | string;
+        };
+        StaffCustomerSessionRevocationResponse: {
+            /** Format: uuid */
+            customerId: string;
+            /** Format: date-time */
+            revokedAtUtc: string;
+            verificationMethod: string;
+        };
         StaffNameResponse: {
             subjectId: string;
             displayName: string;
@@ -16763,6 +16825,102 @@ export interface operations {
             };
         };
     };
+    ListCustomerVerificationMethods: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CustomerVerificationMethodResponse"][];
+                };
+            };
+        };
+    };
+    RevokeCustomerSessions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StaffCustomerSessionRevocationRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StaffCustomerSessionRevocationResponse"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HttpValidationProblemDetails"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Conflict. A type of urn:brokerplatform:problem:concurrency-conflict means someone else changed the record first and nothing was written: read it again and decide again. Any other type is a conflict this operation decided itself, and retrying it unchanged will not help. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ConcurrencyConflictProblem"] | components["schemas"]["ProblemDetails"];
+                };
+            };
+        };
+    };
+    ListActingContexts: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
+                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ActingContextResponse"][];
+                };
+            };
+        };
+    };
     ListOrganisations: {
         parameters: {
             query?: {
@@ -17142,31 +17300,6 @@ export interface operations {
             };
         };
     };
-    ListActingContexts: {
-        parameters: {
-            query?: never;
-            header?: {
-                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
-                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
-            };
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
-                    "X-Broker-Acting-For"?: string;
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ActingContextResponse"][];
-                };
-            };
-        };
-    };
     AcceptOrganisationMembership: {
         parameters: {
             query?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insurance-broker/api-client",
-  "version": "5.20.0",
+  "version": "5.21.0",
   "description": "Generated TypeScript client for the Insurance Broker Platform API. Do not edit by hand: regenerate with scripts/update-api-contract.",
   "license": "UNLICENSED",
   "private": false,