@keboola/api-client 53.0.0 → 55.0.0

package/dist/{types-DjWubjvP.d.cts → types-DMhgKHCP.d.cts}

@@ -195,7 +195,17 @@ type paths = {
       path?: never;
       cookie?: never;
     };
-    get?: never;
+    /**
+     * List platform consumers
+     * @description Every registration on the stack, oldest first. Requires the
+     *     `oauth:platform-consumers-manage` scope. Neither the private key nor the client secret is
+     *     returned.
+     *
+     *     This is how to find the id of an existing registration: a second registration for the
+     *     same host is refused with `409` without naming it. `connectionsCount` tells whether a
+     *     `DELETE` of the registration would be refused.
+     */
+    get: operations['platformConsumerList'];
     put?: never;
     /**
      * Register a platform application
@@ -210,14 +220,15 @@ type paths = {
      *     registration is usable):
      *
      *     * Repository permissions: Contents → Read-only; Organization permissions: Members →
-     *       Read-only (the install callback needs it to confirm the installer owns the GitHub
+     *       Read-only (the callback needs it to confirm the user connecting owns the GitHub
      *       organization).
-     *     * "Where can this GitHub App be installed?" → Any account.
-     *     * **"Request user authorization (OAuth) during installation" must be enabled**, and the
-     *       App's Callback URL set to this service's
-     *       `/platform-consumers/github-app/callback`. Without it GitHub sends no `code` with the
-     *       install redirect, the callback cannot prove the installer owns the installation they
-     *       returned with, and every connection attempt fails there.
+     *     * "Where can this GitHub App be installed?" → Any account, for an App that third parties
+     *       install.
+     *     * The App's Callback URL list must include this service's
+     *       `/platform-consumers/github-app/callback`: connecting goes through the App's OAuth web
+     *       flow with that URL as `redirect_uri`. "Request user authorization (OAuth) during
+     *       installation" is not needed; when it is on, the redirect GitHub sends right after an
+     *       install has no `state` and is answered with directions to connect from Keboola.
      *     * `clientId` / `clientSecret` come from the same App's page ("Client ID", "Generate a new
      *       client secret") — they are not the App ID and private key.
      *
@@ -265,10 +276,11 @@ type paths = {
       cookie?: never;
     };
     /**
-     * GitHub App install callback
-     * @description Invoked by GitHub, not by API consumers. This is the App's Callback URL, configured once on
-     *     the GitHub side and identical for every install, which is why it carries no organization
-     *     segment — the organization is recovered from the install session that `state` resolves to.
+     * GitHub App OAuth callback
+     * @description Invoked by GitHub, not by API consumers. This is one of the App's Callback URLs, configured
+     *     once on the GitHub side and identical for every connection, which is why it carries no
+     *     organization segment — the organization is recovered from the install session that `state`
+     *     resolves to.
      *
      *     It is the only endpoint that records an installation, and it requires no Keboola credential.
      *     Three things authorise it, all of them necessary:
@@ -276,27 +288,44 @@ type paths = {
      *     1. `state` must match the `__Host-orgInstallSession` cookie set when the flow started (the
      *        legacy `oauthSessionId` cookie is ignored here);
      *     2. `state` must resolve to an unexpired install session;
-     *     3. the installing user must own the account the installation belongs to. GitHub, asked as
-     *        the App, says which account that is (`GET /app/installations/{id}`); asked with the
-     *        user-to-server token obtained from `code`, it says whether the installer is an active
-     *        owner of that organization (`GET /user/memberships/orgs/{login}` → `role: admin`,
-     *        `state: active`) or, for a personal account, that very user (`GET /user`). Being a
-     *        collaborator or an ordinary member is not enough.
+     *     3. the user who authorized (`code`, exchanged for a user-to-server token) must own the
+     *        account the bound installation belongs to: an active owner of that organization
+     *        (`GET /user/memberships/orgs/{login}` → `role: admin`, `state: active`) or, for a
+     *        personal account, that very user (`GET /user`). Being a collaborator or an ordinary
+     *        member is not enough. This is why the App needs "Organization members: read".
      *
-     *     Point 3 is why the App needs "Request user authorization (OAuth) during installation" and
-     *     the "Organization members: read" permission. Installation ids are small sequential
-     *     integers, so without that confirmation anyone able to start an install for an organization
-     *     they do administer could bind a stranger's installation and mint read tokens on that
-     *     stranger's private repositories.
+     *     Which installation is bound:
      *
-     *     When the installer is not a GitHub organization owner, GitHub returns
-     *     `setup_action=request` with no installation id: the installation is pending an owner's
-     *     approval and nothing is recorded.
+     *     * **OAuth web flow** (started by `POST /authorize/organizations/{organizationId}`; only
+     *       `code` and `state` come back): the App's installations the user can reach
+     *       (`GET /user/installations`, all pages), narrowed to the `account` given at the start if
+     *       any, each run through check 3. Exactly one owned installation is connected. None
+     *       installed is a `400` and none owned a `403`, both naming the App's install page
+     *       (`/apps/{slug}/installations/new` on github.com, `/github-apps/…` on GitHub Enterprise
+     *       Server); several owned without `account` is a `400`
+     *       naming them — start again with `account`.
+     *     * **No `state`** — GitHub's redirect after an install started on GitHub, for an App that
+     *       requests user authorization during installation: a `400` saying the connection has to
+     *       be started from Keboola. Nothing is asked of GitHub or recorded.
+     *
+     *     Any `installation_id` GitHub adds to the query is ignored. Installation ids are small
+     *     sequential integers: believing one would let anyone able to start a connection for an
+     *     organization they do administer bind a stranger's installation and mint read tokens on
+     *     that stranger's private repositories.
      *
      *     An organization holds at most one connection per GitHub account and registration. When the
      *     account is already connected under a *different* installation id — the App was
      *     uninstalled and installed again — the stale connection is replaced by the new one.
      *     Connecting the very same installation twice is a `409`.
+     *
+     *     **Errors.** Once `state` resolves to a live session, every failure redirects (`302`) to the
+     *     session's `returnUrl` with `error` (an `OrganizationConnectErrorCode`) and `message` added
+     *     to its query — plus `accounts` for `severalOwned`, and `exceptionId` matching the log
+     *     record — and ends the session (GitHub's `code`
+     *     is single-use, so the flow has to start again). The statuses below name the same failures
+     *     as they are answered elsewhere. Only the failures before that, which leave no `returnUrl`
+     *     to go back to — no `state`, no matching cookie, an unknown or expired session — are
+     *     answered with JSON.
      */
     get: operations['platformConsumerInstallCallback'];
     put?: never;
@@ -318,23 +347,30 @@ type paths = {
     put?: never;
     /**
      * Connect a GitHub organization
-     * @description Starts the GitHub App install flow and redirects to GitHub.
+     * @description Starts connecting a GitHub organization and redirects to the GitHub App's OAuth web flow,
+     *     `{webBaseUrl}/login/oauth/authorize?client_id=…&redirect_uri=…&state=…`, where
+     *     `redirect_uri` is this service's `/platform-consumers/github-app/callback`. GitHub signs
+     *     the user in, asks them to authorize the App the first time, and returns to the callback,
+     *     which connects the installation the user owns (or the one on `account`). The App must
+     *     already be installed on the GitHub organization — by anyone, from anywhere; the callback
+     *     links the install page if it is not.
      *
-     *     Submitted by the browser as a form — a top-level navigation — exactly like
-     *     `POST /authorize/{componentId}`, with the caller's Storage API token in the `token` form
-     *     field, verified with Storage API by this service. The token may belong to any project the
-     *     caller can reach: it establishes only *who* the caller is. A token without an admin
-     *     (component or legacy token) is refused with `403`.
+     *     Submitted by the browser as a form — a top-level navigation from the organization's page
+     *     in the Control Panel — with the caller's Manage API token in the `manageToken` form field,
+     *     verified by this service with `GET /manage/tokens/verify`. The token must have a user
+     *     behind it: the Control Panel's session token or a personal Manage token. An application
+     *     token is refused with `403`; a token Manage API does not know, or reports as expired or
+     *     disabled, with `401`. Storage API tokens and programmatic `kbc_pat_*` tokens are not
+     *     accepted. The token establishes only *who* the
+     *     caller is, and it is never stored.
      *
      *     The organization is taken from the URL and the caller must be an administrator of it — `GET /manage/organizations/{id}/users` is
      *     Connection's organization administrators listing, so appearing in it is the admin check.
-     *     Deriving the organization from the token instead would be unsafe — users belong to projects
-     *     across several organizations and the project-to-organization link is invisible in the UI.
+     *     Super admins who are not listed are refused.
      *
      *     The credentials row is created incomplete and only becomes usable once the install
      *     callback records the installation. Starting again under the name of an incomplete row (an
-     *     abandoned tab, or an install that became an owner-approval request) replaces that row and
-     *     its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
+     *     abandoned tab or a refused callback) replaces that row and its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
      *     already taken by a completed connection is a `409`.
      *
      *     The response sets the session cookie `__Host-orgInstallSession` (Secure, HttpOnly,
@@ -347,7 +383,14 @@ type paths = {
      *     Login-CSRF guard: the request must carry an `Origin` header exactly equal to an allowed
      *     origin — `ORGANIZATION_INSTALL_ALLOWED_ORIGINS`, by default the stack's own UI
      *     `https://connection.<HOSTNAME_SUFFIX>`. A missing, `null` or other origin is a `403`, with
-     *     nothing verified or written.
+     *     nothing verified or written. `returnUrl` must be on an allowed origin too (a `400`
+     *     otherwise), as errors are redirected there.
+     *
+     *     **Errors.** Past those checks, every failure redirects (`302`) to `returnUrl` with `error`
+     *     (an `OrganizationConnectErrorCode`) and `message` added to its query, instead of a JSON
+     *     error page the user would be stranded on. The `401`/`403`/`409`/`412`/`503` below name the
+     *     same failures as they are answered elsewhere. Only an invalid form (`422`), an untrusted
+     *     `Origin` (`403`) and a `returnUrl` outside the UI (`400`) are answered with JSON.
      */
     post: operations['organizationCredentialsInit'];
     delete?: never;
@@ -366,7 +409,8 @@ type paths = {
     /**
      * List connected GitHub organizations
      * @description Lists the GitHub accounts this Keboola organization has connected. Connections whose
-     *     install never completed are omitted.
+     *     install never completed are omitted. The caller must be an administrator of the
+     *     organization; see `ManageApiUserToken` for the accepted tokens.
      */
     get: operations['organizationCredentialsList'];
     put?: never;
@@ -377,6 +421,45 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/organizations/{organizationId}/github-apps': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the GitHub Apps an organization can connect to
+     * @description GitHub Apps registered on this stack and where to install each. Connecting needs the App
+     *     installed on the GitHub organization first, so the UI links `installUrl` next to
+     *     "connect".
+     *
+     *     Listed are the stack's default host and the hosts the organization already has a
+     *     completed connection on — not every registration: those are not tied to an
+     *     organization, and the stack's GitHub Enterprise hosts name other customers. A GitHub
+     *     Enterprise host the organization has not connected yet is still connected to by naming
+     *     it in the connect form's `host`.
+     *
+     *     `installUrl` is `/apps/{slug}/installations/new` on github.com and
+     *     `/github-apps/{slug}/installations/new` on GitHub Enterprise Server. It is null on GitHub
+     *     Enterprise Cloud (`*.ghe.com`), which has no working public App page: an App is installed
+     *     there from the GitHub organization's settings
+     *     (`{webBaseUrl}/organizations/{organization}/settings/apps`) or, for an App owned by a
+     *     GitHub enterprise, the enterprise's. `default` marks the host used when the connect form
+     *     names none; it is listed first, the rest by host. Nothing secret is listed.
+     *
+     *     The caller must be an administrator of the organization; see `ManageApiUserToken` for the
+     *     accepted tokens.
+     */
+    get: operations['organizationGitHubAppsList'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/organization-credentials/connections': {
     parameters: {
       query?: never;
@@ -423,7 +506,8 @@ type paths = {
     /**
      * Disconnect a GitHub organization
      * @description Removes the connection on the Keboola side. The App stays installed on GitHub until an
-     *     owner removes it there.
+     *     owner removes it there. The caller must be an administrator of the organization; see
+     *     `ManageApiUserToken` for the accepted tokens.
      */
     delete: operations['organizationCredentialsDelete'];
     options?: never;
@@ -510,7 +594,7 @@ type components = {
        */
       appId: string;
       /**
-       * @description GitHub App slug, used to build the install URL `{webBaseUrl}/apps/{slug}/installations/new`.
+       * @description GitHub App slug, used to build the install URL (`/apps/{slug}/installations/new` on github.com, `/github-apps/…` on GitHub Enterprise Server).
        * @example keboola-data-apps
        */
       slug: string;
@@ -554,9 +638,15 @@ type components = {
        */
       webHost?: string;
     };
+    PlatformConsumerListItem: components['schemas']['PlatformConsumer'] & {
+      /** Format: date-time */
+      created?: string;
+      /** @description Organization connections using this registration, including ones whose install never completed. A `DELETE` is refused while it is not 0. */
+      connectionsCount?: number;
+    };
     OrganizationCredentialsInitRequest: {
-      /** @description Storage API token of the caller; identifies who they are */
-      token: string;
+      /** @description Manage API token of the caller with a user behind it (the Control Panel's session token or a personal Manage token); identifies who they are */
+      manageToken: string;
       /**
        * @description Unique within the organization.
        * @example acme-github
@@ -564,7 +654,8 @@ type components = {
       name: string;
       /**
        * Format: url
-       * @description Where GitHub returns the user after the install completes. Must be https.
+       * @description Where the browser returns after the connection completes, or with `error` and `message` added to its query when it fails (see `OrganizationConnectErrorCode`). Must be https and on an allowed origin (`ORGANIZATION_INSTALL_ALLOWED_ORIGINS`, by default the stack's own UI); its own query is kept.
+       * @example https://connection.keboola.com/control/organizations/433?tab=github
        */
       returnUrl: string;
       description?: string | null;
@@ -573,6 +664,11 @@ type components = {
        * @example acme.ghe.com
        */
       host?: string | null;
+      /**
+       * @description The GitHub account (organization or user login, case-insensitive) to connect. Needed only when the caller owns several accounts the GitHub App is installed on; omitted, the callback connects the only one.
+       * @example acme
+       */
+      account?: string | null;
     };
     OrganizationCredentials: {
       /** Format: uuid */
@@ -590,12 +686,56 @@ type components = {
        */
       host?: string;
       creator?: {
+        /** @description ID of the token the connection was started with. */
         id?: string;
+        /** @description Description of that token; for the Control Panel's session token, the user's email. */
         description?: string | null;
+        /**
+         * @description Which API the token belongs to. Connections are started with a Manage API token; `storage` marks connections started with a Storage API token before that.
+         * @enum {string}
+         */
+        type?: 'manage' | 'storage';
+        /** @description The user behind the Manage API token. A session token expires after about an hour, so this is what still says who connected the organization. Null for `storage`. */
+        user?: {
+          /** @example 76 */
+          id?: string;
+          /** @example admin@keboola.com */
+          email?: string | null;
+        } | null;
       };
       /** Format: date-time */
       created?: string;
     };
+    /**
+     * @description Why connecting an organization to a GitHub App failed, sent as `error` in the query of the `returnUrl` the browser is redirected to (together with `message`, an English explanation; `exceptionId`, matching the log record; and for `severalOwned`, `accounts`). Stable: a value is never renamed, so the UI can map it to its own copy; new values may be added, so treat an unknown one like `connectFailed`. Anyone can link the UI page with an `error` and `message` of their choosing: show the UI's own copy per `error`, never render `message` as HTML or links, and take the install link from `GET /organizations/{organizationId}/github-apps`.
+     * @enum {string}
+     */
+    OrganizationConnectErrorCode: 'invalidToken' | 'notUserToken' | 'notOrganizationAdmin' | 'noAppForHost' | 'nameTaken' | 'authorizationDenied' | 'authorizationFailed' | 'appNotInstalled' | 'notOwner' | 'samlSsoRequired' | 'missingMembersPermission' | 'severalOwned' | 'alreadyConnected' | 'superseded' | 'rateLimited' | 'githubUnavailable' | 'manageApiUnavailable' | 'connectFailed' | 'internalError';
+    OrganizationGitHubApp: {
+      /**
+       * @description The GitHub deployment, as the connect form's `host` takes it.
+       * @example github.com
+       */
+      host: string;
+      /**
+       * Format: url
+       * @example https://github.com
+       */
+      webBaseUrl: string;
+      /**
+       * @description The App's slug on GitHub.
+       * @example keboola-data-apps
+       */
+      slug: string;
+      /**
+       * Format: url
+       * @description The App's page for installing it on a GitHub account; null on GitHub Enterprise Cloud (`*.ghe.com`), where an App is installed from the organization's or enterprise's settings.
+       * @example https://github.com/apps/keboola-data-apps/installations/new
+       */
+      installUrl: string | null;
+      /** @description The host used when the connect form names none. */
+      default: boolean;
+    };
     OrganizationConnections: {
       connections: {
         /**
@@ -1153,6 +1293,36 @@ interface operations {
       422: components['responses']['422_UnprocessableEntity'];
     };
   };
+  platformConsumerList: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Platform consumers */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PlatformConsumerListItem'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      /** @description The token lacks the `oauth:platform-consumers-manage` scope */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+    };
+  };
   platformConsumerCreate: {
     parameters: {
       query?: never;
@@ -1247,15 +1417,11 @@ interface operations {
   };
   platformConsumerInstallCallback: {
     parameters: {
-      query: {
-        /** @description GitHub installation ID. */
-        installation_id?: string;
-        /** @description Temporary user authorization code. Present only when the App has "Request user authorization (OAuth) during installation" enabled; the callback exchanges it for a user-to-server token and verifies installation ownership with it. */
+      query?: {
+        /** @description Temporary user authorization code; exchanged for a user-to-server token that identifies the user and verifies installation ownership. Missing when the user did not authorize the App (`error=access_denied`). */
         code?: string;
-        /** @description What GitHub did. `request` means an owner still has to approve. */
-        setup_action?: 'install' | 'request' | 'update';
-        /** @description Opaque install-session ID issued when the flow started. */
-        state: string;
+        /** @description Opaque install-session ID issued when the flow started. Required; GitHub omits it on the redirect after an install started on GitHub, which is answered with a `400`. */
+        state?: string;
       };
       header?: never;
       path?: never;
@@ -1263,25 +1429,45 @@ interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description Redirect back to the `returnUrl` supplied when the flow started */
+      /**
+       * @description Back to the `returnUrl` supplied when the flow started: as is when the connection is
+       *     recorded, or with `error`, `message` (and for `severalOwned`, `accounts`) added to its
+       *     query when it failed — see `OrganizationConnectErrorCode`:
+       *
+       *     * `authorizationDenied` — no `code`, `error=access_denied`: the user did not authorize
+       *       the App;
+       *     * `authorizationFailed` — GitHub rejected the `code` (expired or already used), or
+       *       returned none for another reason, e.g. `redirect_uri_mismatch` (GitHub's `error`
+       *       and `error_description` are logged, not passed on);
+       *     * `appNotInstalled` — the App is not installed on any account the user can reach (or on
+       *       the requested `account`); the message links the install page;
+       *     * `notOwner` — the user owns none of those accounts (or not the requested `account`):
+       *       neither an active owner of the organization nor the personal account itself; the
+       *       message links the install page;
+       *     * `samlSsoRequired` — the organization enforces SAML SSO the user's GitHub session is
+       *       not authorized for;
+       *     * `missingMembersPermission` — the App lacks "Organization members: read";
+       *     * `severalOwned` — the user owns several accounts with the App installed and no
+       *       `account` was given; `accounts` lists their logins, comma-separated — start again
+       *       with `account` set to one of them;
+       *     * `alreadyConnected` — this installation (or GitHub account) is already connected to the
+       *       organization;
+       *     * `superseded` — a newer start under the same name replaced this attempt while the
+       *       callback ran (nothing is written; finish the newer attempt);
+       *     * `rateLimited`, `githubUnavailable` — GitHub is rate limiting, failing or returned a
+       *       malformed answer;
+       *     * `connectFailed`, `internalError` — anything else.
+       */
       302: {
         headers: {
+          /** @example https://connection.keboola.com/control/organizations/433?tab=github&error=notOwner&message=You%20are%20not%20an%20owner%20of%20%E2%80%A6 */
+          Location?: string;
           [name: string]: unknown;
         };
         content?: never;
       };
-      400: components['responses']['400_BadRequest'];
-      /** @description The installer is not an active owner of the GitHub organization (or not the personal account) the installation belongs to, or the App lacks "Organization members: read" */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          'application/json': components['schemas']['Error'];
-        };
-      };
-      /** @description This installation is already connected to the organization (under the name the message states), the install session was already completed, or this attempt was superseded by a newer start under the same name while the callback ran (nothing is written; finish the newer attempt) */
-      409: {
+      /** @description No `state` (the connection has to be started from Keboola), no matching session cookie, or an unknown or expired session. With no session there is no `returnUrl` to go back to. */
+      400: {
         headers: {
           [name: string]: unknown;
         };
@@ -1307,17 +1493,30 @@ interface operations {
       };
     };
     responses: {
-      /** @description Redirect to GitHub to install the App */
+      /**
+       * @description To the GitHub App's OAuth web flow (`/login/oauth/authorize`); or, when the connection
+       *     cannot start, back to `returnUrl` with `error` and `message` added to its query — see
+       *     `OrganizationConnectErrorCode`:
+       *
+       *     * `invalidToken` — Manage API does not know the token, or it is expired or disabled
+       *       (`401`);
+       *     * `notUserToken` — an application token, with no user behind it (`403`);
+       *     * `notOrganizationAdmin` — the caller does not administer the organization (`403`);
+       *     * `noAppForHost` — no GitHub App is registered for that host on this stack (`412`);
+       *     * `nameTaken` — a completed connection with this name already exists in the
+       *       organization (`409`);
+       *     * `manageApiUnavailable` — Manage API is unavailable (`503`);
+       *     * `connectFailed`, `internalError` — anything else.
+       */
       302: {
         headers: {
+          Location?: string;
           [name: string]: unknown;
         };
         content?: never;
       };
-      400: components['responses']['400_BadRequest'];
-      403: components['responses']['403_Forbidden'];
-      /** @description A completed connection with this name already exists in the organization */
-      409: {
+      /** @description `returnUrl` is not on an allowed origin */
+      400: {
         headers: {
           [name: string]: unknown;
         };
@@ -1325,8 +1524,8 @@ interface operations {
           'application/json': components['schemas']['Error'];
         };
       };
-      /** @description No GitHub App is registered for that host on this stack */
-      412: {
+      /** @description The request's `Origin` is missing or not allowed */
+      403: {
         headers: {
           [name: string]: unknown;
         };
@@ -1335,7 +1534,6 @@ interface operations {
         };
       };
       422: components['responses']['422_UnprocessableEntity'];
-      503: components['responses']['503_ServiceUnavailable'];
     };
   };
   organizationCredentialsList: {
@@ -1364,6 +1562,32 @@ interface operations {
       503: components['responses']['503_ServiceUnavailable'];
     };
   };
+  organizationGitHubAppsList: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Numeric Keboola organization ID. Always explicit — it is never derived from the token, because a user typically belongs to projects across several organizations. */
+        organizationId: components['parameters']['OrganizationId'];
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Registered GitHub Apps, one per host */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['OrganizationGitHubApp'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      503: components['responses']['503_ServiceUnavailable'];
+    };
+  };
   organizationCredentialsConnections: {
     parameters: {
       query?: never;
@@ -1526,5 +1750,16 @@ type CredentialInput = ComponentPath & {
 type CreateCredentialInput = ComponentPath & Omit<CreateCredentialBody, '#data'> & {
   data: Record<string, unknown>;
 };
-export { CredentialInput as a, GetCredentialsInput as c, Credential as i, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, OrganizationConnection as s, ComponentPath as t };
-//# sourceMappingURL=types-DjWubjvP.d.cts.map
+type OrganizationCredentials = OpenapiReturnType<paths['/organizations/{organizationId}/credentials']['get']>[number];
+type ManageTokenInput = {
+  /** A Manage API token with a user behind it, e.g. the Control Panel's session token. */
+  manageToken: string;
+};
+type GetOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials']['get']> & ManageTokenInput;
+type GetOrganizationGitHubAppsInput = OpenapiPathType<paths['/organizations/{organizationId}/github-apps']['get']> & ManageTokenInput;
+type OrganizationGitHubApp = components['schemas']['OrganizationGitHubApp'];
+type OrganizationConnectErrorCode = components['schemas']['OrganizationConnectErrorCode'];
+type DeleteOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials/{id}']['delete']> & ManageTokenInput;
+type GetOrganizationConnectFormInput = OpenapiPathType<paths['/authorize/organizations/{organizationId}']['post']> & OpenapiBodyType<paths['/authorize/organizations/{organizationId}']['post']>;
+export { CredentialInput as a, GetOrganizationConnectFormInput as c, OrganizationConnectErrorCode as d, OrganizationConnection as f, GetCredentialsInput as h, Credential as i, GetOrganizationCredentialsInput as l, OrganizationGitHubApp as m, CreateCredentialBody as n, CredentialPath as o, OrganizationCredentials as p, CreateCredentialInput as r, DeleteOrganizationCredentialsInput as s, ComponentPath as t, GetOrganizationGitHubAppsInput as u };
+//# sourceMappingURL=types-DMhgKHCP.d.cts.map