@keboola/api-client 12.0.0 → 13.0.0

package/dist/types-CBYDpcI1.d.ts

@@ -0,0 +1,1786 @@
+import { b as OpenapiBodyType, c as OpenapiPathType, a as OpenapiReturnType } from './types-auVqO7UT.js';
+
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+type paths = {
+  '/v1/auth/login': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Authenticate user
+     * @description Grant-type dispatcher for user authentication. Supports the password grant (email + password) and the google/microsoft OAuth grants (OIDC ID token issued by the provider).
+     */
+    post: operations['post_/v1/auth/login'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/device/approve': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Approve or deny a device authorization
+     * @description Approves or denies a pending CLI device authorization from a browser session or programmatic session bearer.
+     */
+    post: operations['post_auth_device_authorization_approve'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/device': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Create a device authorization
+     * @description Starts the CLI device authorization flow and returns polling and browser verification details.
+     */
+    post: operations['post_auth_device_authorization_create'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/device/token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Poll a device authorization
+     * @description Polls the CLI device authorization and returns a programmatic session after browser approval.
+     */
+    post: operations['post_auth_device_authorization_token'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/mfa': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Verify MFA challenge
+     * @description Verifies an MFA challenge code and issues session tokens on success.
+     */
+    post: operations['post_/v1/auth/mfa'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/pat': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Personal Access Tokens
+     * @description Returns the active (non-revoked, non-expired) PATs visible to the caller. With a session bearer the response covers every PAT the admin owns; with a PAT bearer the response is restricted to the calling PAT and its descendants.
+     */
+    get: operations['get_auth_pat_list'];
+    put?: never;
+    /**
+     * Create a Personal Access Token
+     * @description Issues a user-created PAT. Requires an active sudo window. The bearer token is returned once in the response and never again.
+     */
+    post: operations['post_auth_pat_create'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/pat/exchange': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Exchange a parent token for a narrower PAT
+     * @description RFC-8693-inspired bearer token exchange (Keboola-internal wire format, not RFC-compliant). The parent bearer (session or PAT) is supplied in the Authorization header. The body carries only the requested attenuation (narrower scope, shorter TTL). The server enforces intersection semantics — the child can never broaden the parent.
+     */
+    post: operations['post_auth_pat_exchange'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/pat/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Revoke a Personal Access Token
+     * @description Revokes a PAT and cascades the revocation to every PAT-derived descendant. With a session bearer the caller may revoke any PAT they own (or any PAT on the stack if a super admin); with a PAT bearer the caller may only revoke the calling PAT itself or a descendant in its subtree. Idempotent.
+     */
+    delete: operations['delete_auth_pat_revoke'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/pkce/token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Exchange a PKCE authorization code for a CLI session
+     * @description Exchanges a same-machine browser authorization code using a PKCE S256 verifier.
+     */
+    post: operations['post_auth_pkce_token'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/mfa/recovery-codes': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Regenerate MFA recovery codes
+     * @description Generates a new set of MFA recovery codes for the authenticated admin. All existing codes are invalidated. Codes are returned in plaintext exactly once.
+     */
+    post: operations['post_auth_mfa_recovery_codes_regenerate'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/saml/assert': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Authenticate with a SAML assertion
+     * @description Validates the SAML assertion correlated by the request handle and issues a session (or an MFA challenge for MFA-enabled admins).
+     */
+    post: operations['post_/v1/auth/saml/assert'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/saml/initiate': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Start a programmatic SAML login
+     * @description Builds an SP-initiated SAML AuthnRequest and returns the IdP SSO URL plus a one-time request handle to submit with the assertion at POST /v1/auth/saml/assert.
+     */
+    post: operations['post_/v1/auth/saml/initiate'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/sessions': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List active sessions
+     * @description Lists all active programmatic sessions for the authenticated admin.
+     */
+    get: operations['get_auth_sessions_list'];
+    put?: never;
+    post?: never;
+    /**
+     * Revoke all sessions
+     * @description Revokes all active programmatic sessions for the authenticated admin. Requires an active sudo window.
+     */
+    delete: operations['delete_auth_sessions_revoke_all'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/sessions/{sessionId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Revoke a session
+     * @description Revokes a specific programmatic session by its ID. Sudo is required only when revoking another admin's session as a super admin.
+     */
+    delete: operations['delete_auth_sessions_revoke_one'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/sudo': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Step-up authentication (sudo)
+     * @description Verifies a TOTP or recovery code and activates a sudo window on the current session. Required for sensitive operations annotated with #[RequiresSudo].
+     */
+    post: operations['post_/v1/auth/sudo'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/sudo/challenge': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Create a WebAuthn step-up (sudo) challenge
+     * @description Generates WebAuthn assertion options and a challenge token for the current session, to be completed via POST /v1/auth/sudo.
+     */
+    post: operations['post_/v1/auth/sudo/challenge'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/token/introspect': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Introspect access token
+     * @description Returns metadata about the currently authenticated session including admin details and sudo-verification status.
+     */
+    get: operations['get_/v1/auth/token/introspect'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/token/refresh': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Refresh access token
+     * @description Exchanges a refresh token for a new access and refresh token pair. Implements two-phase rotation with replay detection.
+     */
+    post: operations['post_/v1/auth/token/refresh'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/token/revoke': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Revoke token
+     * @description Token revocation endpoint with silent-success semantics (silent success on unknown/invalid tokens, hint-as-hint fallback across token types) using the project-wide JSON + camelCase convention. For any well-formed request the response is 200 regardless of whether the token was found or valid, to prevent information leakage about token state. Malformed JSON or a missing required `token` field still produces 400 from the request-mapping layer — this is a wire-format failure, not a token-state signal.
+     */
+    post: operations['post_/v1/auth/token/revoke'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+};
+type components = {
+  schemas: {
+    LoginRequest: {
+      /**
+       * @description Authentication grant type.
+       * @enum {string}
+       */
+      grantType: 'password' | 'google' | 'microsoft';
+      /**
+       * Format: email
+       * @description Email address. Required for password grant.
+       */
+      email?: string | null;
+      /** @description Password. Required for password grant. */
+      password?: string | null;
+      /** @description OIDC ID token issued by the identity provider. Required for google/microsoft grants. */
+      idToken?: string | null;
+    };
+    DeviceAuthorizationCreateRequest: {
+      /** @description Public CLI client identifier. */
+      clientId: string;
+      scope: {
+        /** @enum {string} */
+        credentialType?: 'session';
+      };
+    };
+    DeviceAuthorizationTokenRequest: {
+      /** @description Public CLI client identifier. */
+      clientId: string;
+      /** @description High-entropy device code returned by create. */
+      deviceCode: string;
+    };
+    MfaRequest: {
+      /** @description MFA challenge token from login response. */
+      mfaToken: string;
+      /**
+       * @description Type of MFA verification being submitted.
+       * @enum {string}
+       */
+      type: 'totp' | 'recovery_code' | 'webauthn';
+      /** @description Verification code: 6-digit TOTP for type=totp, recovery code string for type=recovery_code. Required when type is totp or recovery_code. */
+      code: string;
+      /** @description WebAuthn assertion response as JSON string. Required when type is webauthn. */
+      assertion: string;
+    };
+    ScopeRequestPayload: {
+      /**
+       * @description Explicit allow-list of project ids. Omit the field (do not send `null`) to inherit the parent scope verbatim (exchange) or default to all projects (user-create).
+       * @default null
+       */
+      projects: string[] | null;
+      /**
+       * @description Whether the resulting token is read-only. Omit the field (do not send `null`) to default to false (user-create) or inherit (exchange). On exchange `readOnly` may only narrow the parent, never relax it.
+       * @default null
+       */
+      readOnly: boolean | null;
+    };
+    PatCreateRequest: {
+      /** @description User-facing label. */
+      name: string;
+      /** @description Requested lifetime in seconds. Capped at the org policy maximum. Omit (do not send `null`) to default to the cap. */
+      expiresIn: number;
+      scope: components['schemas']['ScopeRequestPayload'];
+    };
+    PatExchangeRequest: {
+      /** @description Requested lifetime in seconds. Capped at the parent-type maximum. Omit (do not send `null`) to use the parent-type TTL cap as the lifetime. */
+      expiresIn: number;
+      scope: components['schemas']['ScopeRequestPayload'];
+    };
+    PkceAuthorizationTokenRequest: {
+      clientId: string;
+      code: string;
+      /** Format: uri */
+      redirectUri: string;
+      state: string;
+      codeVerifier: string;
+    };
+    SamlAssertRequest: {
+      /** @description Base64-encoded SAML response from the IdP. */
+      samlResponse: string;
+      /** @description One-time handle returned by /v1/auth/saml/initiate. */
+      requestHandle: string;
+      /** @description Advisory customer slug; the handle is the authoritative config selector. */
+      customerSlug?: string | null;
+    };
+    SamlInitiateRequest: {
+      /** @description Customer slug of the multi-tenant SAML configuration. Omit for the stack-wide ENV configuration. */
+      customerSlug?: string | null;
+    };
+    SudoRequest: {
+      /** @description TOTP verification code. */
+      totpCode?: string | null;
+      /** @description Recovery code. */
+      recoveryCode?: string | null;
+      /** @description WebAuthn assertion response as JSON string. Requires challengeToken. */
+      webauthnAssertion?: string | null;
+      /** @description Sudo challenge token (kbc_mfa_*) from POST /v1/auth/sudo/challenge. Required when webauthnAssertion is provided. */
+      challengeToken?: string | null;
+    };
+    TokenRefreshRequest: {
+      /** @description Refresh token to exchange for new token pair. */
+      refreshToken: string;
+    };
+    TokenRevokeRequest: {
+      /** @description Token to revoke (access or refresh token). */
+      token: string;
+      /**
+       * @description Hint about the type of token being revoked.
+       * @enum {string|null}
+       */
+      tokenTypeHint?: 'accessToken' | 'refreshToken' | null;
+    };
+    LoginRequest2: {
+      /**
+       * @description Authentication grant type.
+       * @enum {string}
+       */
+      grantType: 'password' | 'google' | 'microsoft';
+      /**
+       * Format: email
+       * @description Email address. Required for password grant.
+       * @default null
+       */
+      email: string | null;
+      /**
+       * @description Password. Required for password grant.
+       * @default null
+       */
+      password: string | null;
+      /**
+       * @description OIDC ID token issued by the identity provider. Required for google/microsoft grants.
+       * @default null
+       */
+      idToken: string | null;
+    };
+    UserLoggedInResponse: {
+      id: number;
+      email: string;
+      name: string;
+    };
+    LoginResponse: {
+      /** @description Opaque bearer access token for API authentication (format: kbc_at_{sessionId}_{secret}). */
+      accessToken: string;
+      /** @description Refresh token for obtaining new access tokens. */
+      refreshToken: string;
+      /** @description Token type. Always "Bearer". */
+      tokenType: string;
+      /** @description Access token lifetime in seconds. */
+      expiresIn: number;
+      /** @description Unique session identifier. */
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    };
+    MfaChallengeResponse: {
+      /** @description Always true when MFA challenge is issued. */
+      mfaRequired: boolean;
+      /** @description Primary MFA method type. */
+      mfaType: string;
+      /** @description MFA challenge token to submit with verification code. */
+      mfaToken: string;
+      /** @description MFA challenge lifetime in seconds. */
+      expiresIn: number;
+      /** @description List of allowed MFA verification methods. */
+      allowedMethods: string[];
+      /**
+       * @description WebAuthn credential request options. Present only when mfaType is webauthn.
+       * @default null
+       */
+      webauthn: Record<string, never> | null;
+    };
+    DeviceAuthorizationApprovalRequest: {
+      /** @description User code to approve or deny. Required in bearer mode; browser mode uses the code stored in the session. */
+      userCode: string;
+      /** @enum {string} */
+      decision: 'approve' | 'deny';
+    };
+    /** @enum {string} */
+    DeviceApprovalDecision: 'approve' | 'deny';
+    DeviceAuthorizationApprovalResult: {
+      /** @enum {string} */
+      status: 'approved' | 'denied';
+      idempotent: boolean;
+      decision: components['schemas']['DeviceApprovalDecision'];
+    };
+    DeviceAuthorizationCreateRequest2: {
+      /** @description Public CLI client identifier. */
+      clientId: string;
+      scope: {
+        /** @enum {string} */
+        credentialType?: 'session';
+      };
+      requestedCredentialType: string;
+    };
+    DeviceAuthorizationCreateResponse: {
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      verificationUriComplete: string;
+      expiresIn: number;
+      interval: number;
+    };
+    CliAuthErrorResponse: {
+      error: string;
+      exceptionId: string;
+      code: string;
+      uuid: string;
+      params: {
+        /** @description Device-flow error token such as authorization_pending, slow_down, or expired_token. */
+        error: string;
+        interval?: number | null;
+      };
+      exceptionDetailUrl: string;
+    };
+    CliTokenResponse: {
+      /** @description Opaque bearer access token for API authentication. */
+      accessToken: string;
+      /** @description Refresh token for obtaining new access tokens. */
+      refreshToken: string;
+      /** @description Token type. Always "Bearer". */
+      tokenType: string;
+      /** @description Access token lifetime in seconds. */
+      expiresIn: number;
+      /** @description Unique session identifier. */
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    };
+    MfaRequest2: {
+      /** @description MFA challenge token from login response. */
+      mfaToken: string;
+      /**
+       * @description Type of MFA verification being submitted.
+       * @enum {string}
+       */
+      type: 'totp' | 'recovery_code' | 'webauthn';
+      /**
+       * @description Verification code: 6-digit TOTP for type=totp, recovery code string for type=recovery_code. Required when type is totp or recovery_code.
+       * @default null
+       */
+      code: string | null;
+      /**
+       * @description WebAuthn assertion response as JSON string. Required when type is webauthn.
+       * @default null
+       */
+      assertion: string | null;
+    };
+    ProjectAccessItem: {
+      /** @description Project id. */
+      id: number;
+      /** @description Project name, or null when the project no longer exists (frozen PAT scope only). */
+      name: string | null;
+      /** @description The admin's role in the project, or null when the admin is no longer a member (frozen PAT scope only). */
+      role: string | null;
+    };
+    PatItemResponse: {
+      /** Format: uuid */
+      id: string;
+      name: string;
+      /** @description Either {"all": true} or {"projects": ["..."]} */
+      scope: Record<string, never>;
+      /** @description Projects the token has rights to. Resolved live for an "all" scope; for a frozen subset scope the issued allow-list is echoed verbatim (a purged project yields name=null, a lost membership yields role=null). */
+      projects: components['schemas']['ProjectAccessItem'][];
+      readOnly: boolean;
+      parentTokenId?: string | null;
+      /** @enum {string|null} */
+      parentTokenType?: 'session' | 'pat' | null;
+      /** Format: date-time */
+      expiresAt: string;
+      /** Format: date-time */
+      lastUsedAt?: string | null;
+      /** Format: date-time */
+      createdAt: string;
+    };
+    PatListResponse: {
+      items: components['schemas']['PatItemResponse'][];
+    };
+    PatCreateRequest2: {
+      /** @description User-facing label. */
+      name: string;
+      /**
+       * @description Requested lifetime in seconds. Capped at the org policy maximum. Omit (do not send `null`) to default to the cap.
+       * @default null
+       */
+      expiresIn: number | null;
+      /**
+       * @description Scope of the issued PAT. Omit (do not send `null`) to default to `{"all": true}`, readOnly=false. Set `readOnly=true` to issue a read-only token (read-only on storage routes; writes are denied).
+       * @default null
+       */
+      scope: components['schemas']['ScopeRequestPayload'] | null;
+    };
+    PatCreateResponse: {
+      /** @description Once-shown bearer token (kbc_pat_*). */
+      accessToken: string;
+      /** @example Bearer */
+      tokenType: string;
+      /** @description Seconds until the token expires. */
+      expiresIn: number;
+      pat: components['schemas']['PatItemResponse'];
+    };
+    PatExchangeRequest2: {
+      /**
+       * @description Requested lifetime in seconds. Capped at the parent-type maximum. Omit (do not send `null`) to use the parent-type TTL cap as the lifetime.
+       * @default null
+       */
+      expiresIn: number | null;
+      /**
+       * @description Requested attenuation of the parent scope. Omit (do not send `null`) to inherit the parent scope verbatim. `readOnly=true` narrows the child to read-only; it cannot be relaxed back to false below a read-only parent.
+       * @default null
+       */
+      scope: components['schemas']['ScopeRequestPayload'] | null;
+    };
+    PatExchangeResponse: {
+      accessToken: string;
+      /** @example Bearer */
+      tokenType: string;
+      expiresIn: number;
+      scope: Record<string, never>;
+      readOnly: boolean;
+      parentTokenId: string;
+      /** @enum {string} */
+      parentTokenType: 'session' | 'pat';
+      /** Format: date-time */
+      expiresAt: string;
+      pat: components['schemas']['PatItemResponse'];
+    };
+    /** @description Plaintext recovery codes returned exactly once on regeneration. */
+    RecoveryCodesRegenerateResponse: {
+      /** @description The newly generated MFA recovery codes. Each code is single-use; existing codes are invalidated. */
+      codes: string[];
+    };
+    SamlAssertRequest2: {
+      /** @description Base64-encoded SAML response from the IdP. */
+      samlResponse: string;
+      /** @description One-time handle returned by /v1/auth/saml/initiate. */
+      requestHandle: string;
+      /**
+       * @description Advisory customer slug; the handle is the authoritative config selector.
+       * @default null
+       */
+      customerSlug: string | null;
+    };
+    SamlInitiateRequest2: {
+      /**
+       * @description Customer slug of the multi-tenant SAML configuration. Omit for the stack-wide ENV configuration.
+       * @default null
+       */
+      customerSlug: string | null;
+    };
+    SamlInitiateResponse: {
+      /** @description IdP single-sign-on URL to redirect the user to (AuthnRequest embedded). */
+      ssoUrl: string;
+      /** @description One-time handle to submit with the SAML response at /v1/auth/saml/assert. */
+      requestHandle: string;
+      /** @description Seconds until the request handle expires. */
+      expiresIn: number;
+    };
+    SessionItemResponse: {
+      /** @description Session identifier. */
+      id: string;
+      /** @description Grant type used to create the session. */
+      grantType: string;
+      /**
+       * Format: date-time
+       * @description Session creation timestamp.
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @description Last time the session was used.
+       */
+      lastUsedAt?: string | null;
+      /** @description IP address of last usage. */
+      lastUsedIp?: string | null;
+      /** @description User agent of the client. */
+      userAgent?: string | null;
+      /**
+       * Format: date-time
+       * @description Access token expiration timestamp.
+       */
+      accessTokenExpiresAt: string;
+      /**
+       * Format: date-time
+       * @description Refresh token expiration timestamp.
+       */
+      refreshTokenExpiresAt: string;
+      /** @description Whether this is the currently authenticated session. */
+      isCurrent: boolean;
+    };
+    SudoRequest2: {
+      /**
+       * @description TOTP verification code.
+       * @default null
+       */
+      totpCode: string | null;
+      /**
+       * @description Recovery code.
+       * @default null
+       */
+      recoveryCode: string | null;
+      /**
+       * @description WebAuthn assertion response as JSON string. Requires challengeToken.
+       * @default null
+       */
+      webauthnAssertion: string | null;
+      /**
+       * @description Sudo challenge token (kbc_mfa_*) from POST /v1/auth/sudo/challenge. Required when webauthnAssertion is provided.
+       * @default null
+       */
+      challengeToken: string | null;
+      type: string;
+    };
+    SudoResponse: {
+      /** @description Whether step-up authentication was successful. */
+      sudoVerified: boolean;
+      /**
+       * Format: date-time
+       * @description When the sudo window expires (RFC 3339 / ISO 8601).
+       */
+      sudoExpiresAt: string;
+      /** @description Sudo window duration in seconds. */
+      sudoTimeoutSeconds: number;
+    };
+    SudoChallengeResponse: {
+      /** @description Challenge token (kbc_mfa_*) to submit alongside the WebAuthn assertion. */
+      challengeToken: string;
+      /** @description Serialized WebAuthn PublicKeyCredentialRequestOptions. */
+      options: Record<string, never>;
+      /** @description Challenge lifetime in seconds. */
+      expiresIn: number;
+    };
+    TokenIntrospectResponse: {
+      /** @description Session identifier. */
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+      /** @description Grant type used to create the session. */
+      grantType: string;
+      /** @description Whether step-up (sudo) verification has been completed for this session. Derived from the session's sudoVerifiedAt timestamp. */
+      sudoVerified: boolean;
+      /**
+       * Format: date-time
+       * @description Session creation timestamp.
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @description Access token expiration timestamp.
+       */
+      expiresAt: string;
+      /**
+       * Format: date-time
+       * @description Last time the session was used.
+       */
+      lastUsedAt?: string | null;
+      /** @description IP address of last usage. */
+      lastUsedIp?: string | null;
+      /** @description User agent of the client. */
+      userAgent?: string | null;
+      /** @description Projects the session has rights to (live access set). */
+      projects: components['schemas']['ProjectAccessItem'][];
+    };
+    TokenRevokeRequest2: {
+      /** @description Token to revoke (access or refresh token). */
+      token: string;
+      /**
+       * @description Hint about the type of token being revoked.
+       * @default null
+       * @enum {string|null}
+       */
+      tokenTypeHint: 'accessToken' | 'refreshToken' | null;
+    };
+  };
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+};
+type operations = {
+  'post_/v1/auth/login': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['LoginRequest2'];
+      };
+    };
+    responses: {
+      /** @description Authentication successful. Returns access and refresh tokens, or MFA challenge if MFA is enabled. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json':
+            | components['schemas']['LoginResponse']
+            | components['schemas']['MfaChallengeResponse'];
+        };
+      };
+      /** @description Invalid request parameters or unsupported grant type. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid credentials or invalid/expired ID token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Login rejected: no matching active account, identity provider tenant mismatch, SSO-enforced account, or super-admin MFA required. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_device_authorization_approve: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['DeviceAuthorizationApprovalRequest'];
+      };
+    };
+    responses: {
+      /** @description Device authorization resolved. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['DeviceAuthorizationApprovalResult'];
+        };
+      };
+      /** @description Request body, decision, browser session code, or device authorization state is invalid. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Browser session or session bearer is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer, CSRF token, or approval authentication context is invalid. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Device authorization feature disabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Device authorization was already resolved with a conflicting decision. */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_device_authorization_create: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['DeviceAuthorizationCreateRequest2'];
+      };
+    };
+    responses: {
+      /** @description Device authorization created. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['DeviceAuthorizationCreateResponse'];
+        };
+      };
+      /** @description Device authorization request is invalid or client credentials are incorrect. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliAuthErrorResponse'];
+        };
+      };
+      /** @description Device authorization feature disabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Device authorization rate limit exceeded. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliAuthErrorResponse'];
+        };
+      };
+    };
+  };
+  post_auth_device_authorization_token: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['DeviceAuthorizationTokenRequest'];
+      };
+    };
+    responses: {
+      /** @description Device authorization consumed. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliTokenResponse'];
+        };
+      };
+      /** @description Device authorization is pending, slowed down, denied, expired, invalid, or client-mismatched. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliAuthErrorResponse'];
+        };
+      };
+      /** @description Device authorization feature disabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/mfa': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['MfaRequest2'];
+      };
+    };
+    responses: {
+      /** @description MFA verification successful. Returns access and refresh tokens. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['LoginResponse'];
+        };
+      };
+      /** @description MFA verification failed: invalid or expired MFA token, invalid TOTP / recovery code, exhausted challenge, or the challenge was already consumed by a concurrent request. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Rate limit exceeded for MFA verification attempts. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  get_auth_pat_list: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description List of PATs visible to the caller. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PatListResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_pat_create: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PatCreateRequest2'];
+      };
+    };
+    responses: {
+      /** @description PAT created. Bearer token is shown in `accessToken` and not retrievable later. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PatCreateResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid request payload. */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT issuance rate limit exceeded. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_pat_exchange: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: {
+      content: {
+        'application/json': components['schemas']['PatExchangeRequest2'];
+      };
+    };
+    responses: {
+      /** @description Child PAT issued. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PatExchangeResponse'];
+        };
+      };
+      /** @description Requested scope exceeds the parent, expiration is invalid, or the parent chain is at the maximum allowed depth. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Missing, malformed, or revoked parent token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT issuance rate limit exceeded. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  delete_auth_pat_revoke: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description PAT identifier (UUID). */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description PAT revoked (or already revoked). */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo step-up required for cross-admin revocation by a super admin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT not found, not authorised for the caller, or programmatic auth disabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_pkce_token: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PkceAuthorizationTokenRequest'];
+      };
+    };
+    responses: {
+      /** @description CLI session issued. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliTokenResponse'];
+        };
+      };
+      /** @description PKCE authorization is denied, expired, invalid, or client-mismatched. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliAuthErrorResponse'];
+        };
+      };
+      /** @description PKCE authorization feature disabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_mfa_recovery_codes_regenerate: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Recovery codes regenerated. Plaintext values are returned only in this response. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['RecoveryCodesRegenerateResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Either the sudo window is not active (call POST /v1/auth/sudo first), or the admin has no MFA configured. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/saml/assert': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SamlAssertRequest2'];
+      };
+    };
+    responses: {
+      /** @description Authentication successful. Returns access and refresh tokens, or an MFA challenge. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json':
+            | components['schemas']['LoginResponse']
+            | components['schemas']['MfaChallengeResponse'];
+        };
+      };
+      /** @description Invalid request parameters. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or expired SAML assertion, or an invalid/used/expired request handle. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Asserted email domain not permitted, or the assertion lacks the required login role. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/saml/initiate': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: {
+      content: {
+        'application/json': components['schemas']['SamlInitiateRequest2'];
+      };
+    };
+    responses: {
+      /** @description SSO URL and one-time request handle. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SamlInitiateResponse'];
+        };
+      };
+      /** @description No SAML configuration for the given customer slug, or SAML is not enabled. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many concurrent pending SAML requests (active-pending cap exceeded). */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  get_auth_sessions_list: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description List of active sessions. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            /** @description List of active sessions. */
+            sessions?: components['schemas']['SessionItemResponse'][];
+          };
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  delete_auth_sessions_revoke_all: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description All sessions revoked successfully. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge. */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  delete_auth_sessions_revoke_one: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Identifier of the session to revoke. */
+        sessionId: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Session revoked successfully. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Returned when a super admin attempts to revoke another admin's session without an active sudo window. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge. */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Session not found. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/sudo': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['SudoRequest2'];
+      };
+    };
+    responses: {
+      /** @description Step-up authentication successful. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SudoResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description MFA is not configured for this account. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Rate limit exceeded for verification attempts. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/sudo/challenge': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description WebAuthn challenge created. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['SudoChallengeResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/v1/auth/token/introspect': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Token introspection result. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TokenIntrospectResponse'];
+        };
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. Clients must treat any non-200 response as "token not active". */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. Use GET /v1/auth/pat to retrieve PAT metadata. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/token/refresh': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TokenRefreshRequest'];
+      };
+    };
+    responses: {
+      /** @description Token refresh successful. Returns new access and refresh tokens. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['LoginResponse'];
+        };
+      };
+      /** @description Invalid, expired, or revoked refresh token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Refresh rotation temporarily failed because of database contention. Retry-After indicates when to retry. */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/token/revoke': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TokenRevokeRequest2'];
+      };
+    };
+    responses: {
+      /** @description Token revocation processed. Returned for every well-formed request, regardless of whether the token was found, valid, expired, or already revoked — prevents information leakage about token state. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Wire-format failure — request body was not valid JSON, or the required `token` field was missing. This is not a token-state signal; the always-200 contract still applies to all token-state branches. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+};
+
+type LoginBody = OpenapiBodyType<paths['/v1/auth/login']['post']>;
+type LoginResult = OpenapiReturnType<paths['/v1/auth/login']['post']>;
+type VerifyMfaBody = OpenapiBodyType<paths['/v1/auth/mfa']['post']>;
+type VerifyMfaResult = OpenapiReturnType<paths['/v1/auth/mfa']['post']>;
+type RegenerateRecoveryCodesResult = OpenapiReturnType<paths['/v1/auth/mfa/recovery-codes']['post']>;
+type SudoBody = OpenapiBodyType<paths['/v1/auth/sudo']['post']>;
+type SudoResult = OpenapiReturnType<paths['/v1/auth/sudo']['post']>;
+type SudoChallengeResult = OpenapiReturnType<paths['/v1/auth/sudo/challenge']['post']>;
+type AssertSamlBody = OpenapiBodyType<paths['/v1/auth/saml/assert']['post']>;
+type AssertSamlResult = OpenapiReturnType<paths['/v1/auth/saml/assert']['post']>;
+type InitiateSamlBody = OpenapiBodyType<paths['/v1/auth/saml/initiate']['post']>;
+type InitiateSamlResult = OpenapiReturnType<paths['/v1/auth/saml/initiate']['post']>;
+type CreateDeviceAuthorizationBody = OpenapiBodyType<paths['/v1/auth/device']['post']>;
+type CreateDeviceAuthorizationResult = OpenapiReturnType<paths['/v1/auth/device']['post']>;
+type ApproveDeviceAuthorizationBody = OpenapiBodyType<paths['/v1/auth/device/approve']['post']>;
+type ApproveDeviceAuthorizationResult = OpenapiReturnType<paths['/v1/auth/device/approve']['post']>;
+type GetDeviceAuthorizationTokenBody = OpenapiBodyType<paths['/v1/auth/device/token']['post']>;
+type GetDeviceAuthorizationTokenResult = OpenapiReturnType<paths['/v1/auth/device/token']['post']>;
+type GetPkceTokenBody = OpenapiBodyType<paths['/v1/auth/pkce/token']['post']>;
+type GetPkceTokenResult = OpenapiReturnType<paths['/v1/auth/pkce/token']['post']>;
+type ListPatsResult = OpenapiReturnType<paths['/v1/auth/pat']['get']>;
+type CreatePatBody = OpenapiBodyType<paths['/v1/auth/pat']['post']>;
+type CreatePatResult = OpenapiReturnType<paths['/v1/auth/pat']['post']>;
+type ExchangePatBody = OpenapiBodyType<paths['/v1/auth/pat/exchange']['post']>;
+type ExchangePatResult = OpenapiReturnType<paths['/v1/auth/pat/exchange']['post']>;
+type RevokePatPath = OpenapiPathType<paths['/v1/auth/pat/{id}']['delete']>;
+type ListSessionsResult = OpenapiReturnType<paths['/v1/auth/sessions']['get']>;
+type RevokeSessionPath = OpenapiPathType<paths['/v1/auth/sessions/{sessionId}']['delete']>;
+type IntrospectTokenResult = OpenapiReturnType<paths['/v1/auth/token/introspect']['get']>;
+type RefreshTokenBody = OpenapiBodyType<paths['/v1/auth/token/refresh']['post']>;
+type RefreshTokenResult = OpenapiReturnType<paths['/v1/auth/token/refresh']['post']>;
+type RevokeTokenBody = OpenapiBodyType<paths['/v1/auth/token/revoke']['post']>;
+
+export type { AssertSamlBody as A, CreateDeviceAuthorizationBody as C, ExchangePatBody as E, GetDeviceAuthorizationTokenBody as G, InitiateSamlBody as I, LoginBody as L, RevokePatPath as R, SudoBody as S, VerifyMfaBody as V, ApproveDeviceAuthorizationBody as a, GetPkceTokenBody as b, components as c, CreatePatBody as d, RevokeSessionPath as e, RefreshTokenBody as f, RevokeTokenBody as g, ApproveDeviceAuthorizationResult as h, AssertSamlResult as i, CreateDeviceAuthorizationResult as j, CreatePatResult as k, ExchangePatResult as l, GetDeviceAuthorizationTokenResult as m, GetPkceTokenResult as n, InitiateSamlResult as o, IntrospectTokenResult as p, ListPatsResult as q, ListSessionsResult as r, LoginResult as s, RefreshTokenResult as t, RegenerateRecoveryCodesResult as u, SudoChallengeResult as v, SudoResult as w, VerifyMfaResult as x };