@limitry/sdk 0.0.0-stage → 1.0.0-rc.3

package/dist/v1.gen.d.ts

@@ -0,0 +1,4207 @@
+export interface paths {
+    "/checks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Check whether a subject may act
+         * @description Asks whether `subject` may do `action` at `cost`, given every enabled limit that applies, and — in `consume` mode — uses it. Always 200 for a decision: read `allowed`; `remaining` shows what is left per limit and `retryAfterSeconds` when to try again. An `Idempotency-Key` header makes a retried check return the same decision without using twice. Its API-key check is cached briefly for speed: a revoked key can keep working here for up to 60 seconds.
+         */
+        post: operations["checks.create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/limits": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List limits
+         * @description The workspace's active limits, newest first (`archived=true`: the archived ones). Filter by `subjectKind` and `action`; paginate with the opaque `nextCursor` token.
+         */
+        get: operations["limits.list"];
+        put?: never;
+        /**
+         * Create a limit
+         * @description Limits how much of an action a subject may use per window — for example 200 cents of `ai-call` a month for every `user`. Checks enforce it from then on. Names are unique among the environment's active limits. Owners and admins only, for a person's token.
+         */
+        post: operations["limits.create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/limits/{limitId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a limit
+         * @description One limit: who it applies to, the action, amount and window.
+         */
+        get: operations["limits.get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Change a limit
+         * @description Changes any of a limit's fields; checks use the new rule within a minute. Owners and admins only, for a person's token.
+         */
+        patch: operations["limits.update"];
+        trace?: never;
+    };
+    "/limits/{limitId}/archive": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Archive a limit
+         * @description Stops a limit: checks stop enforcing it within a minute, and it leaves the list. It is archived, not erased — its usage history and credit grants stay, and `POST /v1/limits/{limitId}/restore` brings it back. Owners and admins only, for a person's token.
+         */
+        post: operations["limits.archive"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/limits/{limitId}/grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a balance's grants
+         * @description Credits added to subjects' balances for this limit, newest first.
+         */
+        get: operations["limits.grants.list"];
+        put?: never;
+        /**
+         * Add credits to a balance
+         * @description Adds `amount` to one subject's balance — a limit whose window is `total`. A negative `amount` takes credits back (a refund, a chargeback) and needs a `note` saying why; the balance may go below zero, and checks are refused until it is topped up. Owners and admins, or a workspace API key; an agent asks a person (the `limit.grant` approval).
+         */
+        post: operations["limits.grants.create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/limits/{limitId}/restore": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Restore an archived limit
+         * @description Brings an archived limit back into force — refused while an active limit has its name. Owners and admins only, for a person's token.
+         */
+        post: operations["limits.restore"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/limits/sync": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sync limits from a list
+         * @description Makes the environment's limits match `limits`, by name: creates the missing, changes those that differ (an omitted field means its default) and, with `archiveMissing`, archives active limits the list doesn't name. Running it twice changes nothing the second time. Limitry checks the whole list first, and a problem anywhere changes nothing (400, each problem in `details`); then it writes every change at once. `dryRun` answers the plan without writing. For keeping limits in a file in your repository (`limitry sync`). Owners and admins only, for a person's token.
+         */
+        post: operations["limits.sync"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/reservations/{reservationId}/commit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Commit a reservation
+         * @description Settles a hold with the ACTUAL amount used (`cost`): less than held gives the rest back at once; more is charged in full — the work happened. A commit after the hold expired still charges `cost`. Repeating a commit answers the same. Its API-key check is cached briefly for speed: a revoked key can keep working here for up to 60 seconds.
+         */
+        post: operations["reservations.commit"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/reservations/{reservationId}/extend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Extend a reservation
+         * @description Keeps a hold for longer work: it now expires `ttlSeconds` from now (default 300, at most 3600) — call it again as a heartbeat. Only a held reservation can be extended. Its API-key check is cached briefly for speed: a revoked key can keep working here for up to 60 seconds.
+         */
+        post: operations["reservations.extend"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/reservations/{reservationId}/release": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Release a reservation
+         * @description Gives the whole hold back — the work did not happen. Repeating a release answers the same; releasing a committed reservation is refused. Its API-key check is cached briefly for speed: a revoked key can keep working here for up to 60 seconds.
+         */
+        post: operations["reservations.release"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/subjects/{subjectKind}/{subjectId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a subject
+         * @description A subject's anchor: when its `anchor` limits' periods start from. A subject is yours (a user, a team, an agent) and exists once a check names it.
+         */
+        get: operations["subjects.get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Set a subject's anchor
+         * @description Sets when a subject's `anchor` limits' periods start from: typically its subscription's start date, from your billing system's webhook, so its allowance refills on its own billing day (monthly for an annual plan, too). Owners and admins only, for a person's token.
+         */
+        patch: operations["subjects.update"];
+        trace?: never;
+    };
+    "/subjects/{subjectKind}/{subjectId}/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reset a subject's limits
+         * @description Refills one limit on a subject (`limitId`), or every limit on it (`{}`), at once: for goodwill, a promotion or support. The schedule doesn't move: the next refill is still the usual one. A balance goes back to its amount; a concurrent limit is skipped. Send an Idempotency-Key and a repeat resets once. Owners and admins only, for a person's token.
+         */
+        post: operations["subjects.reset"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/usage": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a limit's usage over time
+         * @description Units used, checks allowed and denied for one limit — across all subjects, or one (`subjectKind` + `subjectId`) — per hour or per day (UTC), every bucket in the range included. Up to about a minute behind live checks. Default: the last 30 days, by day.
+         */
+        get: operations["usage.query"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/usage/standing": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get where a subject stands
+         * @description Every enabled limit on one subject — and on its shared subjects (`shared`, comma-separated `kind:id`, such as `team:team_42`) — with what is used, what is left and when it resets, exact as of now. For showing an end user where they stand: call it from your server with your key, never from a browser. Not a check: nothing is counted. A subject with no limit here answers an empty `limits` list.
+         */
+        get: operations["usage.standing"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/usage/subjects": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List who is using a limit now
+         * @description A limit's subjects in its CURRENT window, most used first: units used, what is left, how many checks were denied — `over` when any were. Up to about a minute behind live checks.
+         */
+        get: operations["usage.subjects"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the current user
+         * @description Returns the user the personal access token belongs to, with their workspace memberships. Useful as an integration smoke test ("who am I?").
+         */
+        get: operations["user.me"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke the token making this request
+         * @description Revokes the personal access token used to call it — signing out from a script or the CLI (`logout`). The token stops working immediately; other tokens are untouched.
+         */
+        delete: operations["user.revokeToken"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the current workspace
+         * @description Returns the Workspace the credential acts in — the API key's own, or the one named by X-Workspace for a personal access token. Useful as an integration smoke test ("who am I?").
+         */
+        get: operations["workspace.get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/approval-actions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the actions you can ask approval for
+         * @description Actions a credential may not take itself but may ASK a person to approve: each one's input (JSON Schema), who can approve it, and whether it creates a secret.
+         */
+        get: operations["workspace.approvalActions.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/approval-requests": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask a person to approve an action
+         * @description Files a request for an action you may not take yourself (see approval-actions) and notifies everyone who can approve it. Show the person `approveUrl` and why you need it; then check the request until it is decided (it expires after 24 hours). A personal access token or an app a person connected may ask — not a workspace API key.
+         */
+        post: operations["workspace.approvalRequests.create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/approval-requests/{requestId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Check an approval request
+         * @description The request you filed: pending, denied, completed (the action ran — see `result`), approved (waiting for the CLI to redeem it), failed or expired.
+         */
+        get: operations["workspace.approvalRequests.get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/approval-requests/{requestId}/redeem": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeem an approved request
+         * @description Runs an approved, secret-producing action ONCE and returns its secret — to the personal access token that asked, only. The CLI writes it to a file without printing it.
+         */
+        post: operations["workspace.approvalRequests.redeem"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/audit-events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List workspace audit events
+         * @description The workspace's audit trail, newest first. Paginate with the opaque `nextCursor` token; `limit` is clamped to 1–100 (default 25). Owner-only for personal access tokens, like the audit page in the application; a Workspace API key is its workspace and always passes.
+         */
+        get: operations["workspace.auditEvents.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/event-types": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List event types
+         * @description Every workspace event a webhook endpoint can subscribe to, with what it means. Pass some as `eventTypes` when adding an endpoint; an endpoint without a list receives them all.
+         */
+        get: operations["workspace.eventTypes.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/invitations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending invitations
+         * @description Invitations sent and not yet accepted, declined or expired, newest first. Owners and admins only for a personal credential, as in the app. Paginate with the opaque `nextCursor`.
+         */
+        get: operations["workspace.invitations.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List workspace members
+         * @description The workspace's members with their roles, newest first. Paginate with the opaque `nextCursor`; `limit` is clamped to 1–100 (default 25). Members are invited, removed and given roles in the app.
+         */
+        get: operations["workspace.members.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/teams": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List teams
+         * @description The workspace's teams with their members' user ids, newest first. Paginate with the opaque `nextCursor`; `limit` is clamped to 1–100 (default 25). Teams are created and staffed in the app.
+         */
+        get: operations["workspace.teams.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/usage": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get your plan's usage this period
+         * @description How much of each meter the workspace used this period, with the plan's limit for it (null = unlimited). A period is a month from the workspace's billing date: its subscription's (an annual plan refills monthly from its start), else the day the workspace was created.
+         */
+        get: operations["workspace.usage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List webhook endpoints
+         * @description The workspace's outgoing webhook endpoints, newest first, without their signing secrets. A workspace has at most 10, so the list is a single page (`nextCursor` is null).
+         */
+        get: operations["workspace.webhookEndpoints.list"];
+        put?: never;
+        /**
+         * Add a webhook endpoint
+         * @description Registers an https URL to receive the workspace's events, signed Svix-compatibly. The response carries the endpoint's signing secret (`whsec_…`) — shown ONCE, store it to verify deliveries. Private and non-https hosts are refused; at most 10 per workspace.
+         */
+        post: operations["workspace.webhookEndpoints.create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints/{endpointId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a webhook endpoint
+         * @description One endpoint, without its signing secret: whether it is enabled, its consecutive failures and its last delivery status.
+         */
+        get: operations["workspace.webhookEndpoints.get"];
+        put?: never;
+        post?: never;
+        /**
+         * Remove a webhook endpoint
+         * @description Stops all deliveries to the endpoint and deletes it with its secret. Its delivery history goes with it.
+         */
+        delete: operations["workspace.webhookEndpoints.delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints/{endpointId}/deliveries": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an endpoint's deliveries
+         * @description Delivery history for one endpoint, newest first: each event's status, attempts and last HTTP status (payloads are not returned). Kept for 30 days. Paginate with the opaque `nextCursor`.
+         */
+        get: operations["workspace.webhookDeliveries.list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints/{endpointId}/deliveries/{deliveryId}/redeliver": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeliver an event
+         * @description Sends a recorded delivery's event again, as a new delivery with its own history entry; the event id is unchanged, so receivers can deduplicate. The endpoint must be enabled.
+         */
+        post: operations["workspace.webhookDeliveries.redeliver"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints/{endpointId}/enable": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Re-enable a webhook endpoint
+         * @description Resumes deliveries to an endpoint that was disabled after repeated failures, keeping its signing secret; the failure count resets.
+         */
+        post: operations["workspace.webhookEndpoints.enable"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspace/webhook-endpoints/{endpointId}/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test event
+         * @description Sends a `ping` event to the endpoint, signed like every delivery — the way to check an integration verifies and accepts deliveries.
+         */
+        post: operations["workspace.webhookEndpoints.test"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        ApprovalRequest: {
+            /** @example workspace.apiKey.create */
+            action: string;
+            /** @description Where a person approves or denies it — show it to them. */
+            approveUrl: string;
+            createdAt: string;
+            decidedAt: string | null;
+            expiresAt: string;
+            id: string;
+            input: {
+                [key: string]: unknown;
+            };
+            reason: string;
+            requestedBy: string | null;
+            /** @description The outcome — never a secret. */
+            result: {
+                [key: string]: unknown;
+            } | null;
+            /** @description Set when the action creates a secret. */
+            secret: {
+                envVar: string;
+                name: string;
+            } | null;
+            /**
+             * @description `approved` = waiting for the CLI to redeem it (a secret-producing action asked from the CLI).
+             * @enum {string}
+             */
+            status: "pending" | "approved" | "completed" | "denied" | "failed" | "expired";
+            /** @description Exactly what will happen, as the person reads it. */
+            summary: string;
+            title: string;
+        };
+        AuditEvent: {
+            /** @example member.invited */
+            action: string;
+            /**
+             * @description Who is accountable: `user`, `staff`, `system` or `api_key`.
+             * @example user
+             */
+            actorType: string;
+            /** @example 2026-08-19T12:00:00.000Z */
+            createdAt: string;
+            /** @description The API credential the action came through, as named when it happened; null for actions taken in the app. */
+            credential: {
+                /** @example ci */
+                name: string | null;
+                /**
+                 * @description `api_key` or `pat`.
+                 * @example pat
+                 */
+                type: string;
+            } | null;
+            /** @example evt_k3TAiF2ZP5sQxWbV */
+            id: string;
+        };
+        AuditEventPage: {
+            items: components["schemas"]["AuditEvent"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        CheckDecision: {
+            /** @description The answer. `false` is a normal answer, not an error — branch on it. */
+            allowed: boolean;
+            /** @example chk_9d2e… */
+            id: string;
+            /** @description Why not, when `allowed` is false: a limit is used up (`limit` names it), or the subject already holds the most open reservations (1,000). */
+            reason: {
+                /** @enum {string} */
+                code: "limit_exceeded" | "too_many_reservations";
+                /** @example lim_3f0c… */
+                limit: string | null;
+            } | null;
+            /** @description Every limit that applied, and what is left in its window. */
+            remaining: components["schemas"]["CheckRemaining"][];
+            /** @description With `mode: reserve`, when allowed: the hold — commit or release it before `expiresAt`, or it releases itself. */
+            reservation?: {
+                expiresAt: string;
+                /** @example rsv_WyJ1c2VyIiwidV80MiJd_9f… */
+                id: string;
+            };
+            /** @description When `allowed` is false: seconds until it could be allowed. */
+            retryAfterSeconds: number | null;
+        };
+        CheckRemaining: {
+            /**
+             * @description What to do if Limitry cannot be reached next time: `open` allows, `closed` denies. SDKs remember it.
+             * @enum {string}
+             */
+            failMode: "open" | "closed";
+            /** @example lim_3f0c… */
+            limit: string;
+            /** @example AI budget */
+            name: string;
+            /** @example 195 */
+            remaining: number;
+            /**
+             * @description When the window resets — for a rolling limit, when its oldest use leaves the window. Null when nothing will: a balance (`total`), a `concurrent` limit, a rolling limit with nothing in use.
+             * @example 2026-11-01T00:00:00.000Z
+             */
+            resetsAt: string | null;
+            /** @description The limit counts the last window, not the calendar one. */
+            rolling: boolean;
+            /** @example cents */
+            unit: string;
+            /** @enum {string} */
+            window: "minute" | "hour" | "day" | "week" | "month" | "year" | "total" | "concurrent";
+        };
+        CheckRequest: {
+            /**
+             * @description What the subject wants to do.
+             * @example ai-call
+             */
+            action: string;
+            /**
+             * @description Units it would use. Default 1.
+             * @example 5
+             */
+            cost?: number;
+            /**
+             * @description `consume` (default) decides and uses; `preview` decides without using; `reserve` decides and HOLDS `cost` (an estimate) until you commit the actual amount or release it — see `reservation` in the answer. Only a reservation takes a slot of a `concurrent` limit.
+             * @example consume
+             * @enum {string}
+             */
+            mode?: "consume" | "preview" | "reserve";
+            /**
+             * @description Shared subjects it also draws from — a team's, org's or project's pool (at most 4). Every limit on every subject must fit; all are charged, or none.
+             * @example [
+             *       {
+             *         "kind": "team",
+             *         "id": "team_42"
+             *       }
+             *     ]
+             */
+            shared?: {
+                id: string;
+                kind: string;
+            }[];
+            subject: components["schemas"]["CheckSubject"];
+            /**
+             * @description With `reserve`: how long the hold lasts before it releases itself. Default 300, at most 3600.
+             * @example 300
+             */
+            ttlSeconds?: number;
+        };
+        /** @description Who is acting, as `{"kind": "user", "id": "usr_123"}`. */
+        CheckSubject: {
+            /**
+             * @description Who exactly, in your product.
+             * @example usr_123
+             */
+            id: string;
+            /**
+             * @description Your own label for who is acting: user, apikey, agent …
+             * @example user
+             */
+            kind: string;
+        };
+        ErrorEnvelope: {
+            error: {
+                /** @example unauthorized */
+                code: string;
+                details?: {
+                    message: string;
+                    path: string;
+                }[];
+                /**
+                 * @description Link to this error code's entry in the documentation — how to fix it.
+                 * @example https://example.com/docs/errors/#unauthorized
+                 */
+                docs?: string;
+                /** @example Unauthorized */
+                message: string;
+                requestId?: string;
+            };
+        };
+        Invitation: {
+            /** @example 2026-08-19T12:00:00.000Z */
+            createdAt: string;
+            email: string;
+            /** @example 2026-08-21T12:00:00.000Z */
+            expiresAt: string;
+            id: string;
+            /** @example member */
+            role: string | null;
+            /** @description Teams the person joins on accepting (besides the default team, unless a guest). */
+            teamIds: string[];
+        };
+        InvitationPage: {
+            items: components["schemas"]["Invitation"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        Limit: {
+            /**
+             * @description The action it limits; `*` for every action.
+             * @example ai-call
+             */
+            action: string;
+            /**
+             * @description How many units per window — for a `concurrent` limit, how many at once.
+             * @example 200
+             */
+            amount: number;
+            /** @description When it was archived (deleting archives it); null while active. An archived limit isn't enforced; its usage history and credit grants stay. */
+            archivedAt: string | null;
+            /** @example 2026-10-04T12:00:00.000Z */
+            createdAt: string;
+            enabled: boolean;
+            /**
+             * @description How many `window` units a period lasts: `window: "month", every: 3` is a quarter, `window: "hour", every: 5` five hours. Default: 1.
+             * @example 1
+             */
+            every: number;
+            /**
+             * @description What your code should do when Limitry cannot be reached: `open` allows, `closed` denies.
+             * @example closed
+             * @enum {string}
+             */
+            failMode: "open" | "closed";
+            /** @example lim_3f0c… */
+            id: string;
+            /** @example AI budget */
+            name: string;
+            /** @description Counts the last minute, hour or day at the moment of the check instead of the calendar window. */
+            rolling: boolean;
+            /**
+             * @description Where a period begins. `calendar`: UTC boundaries (midnight, Monday, the 1st, 1 January). `anchor`: from the subject's anchor, its billing date, set with `subjects.update` (its first check until then), so an annual plan can refill monthly from its start day. `first_use`: at the first check after the previous period ended. Default: calendar.
+             * @example calendar
+             * @enum {string}
+             */
+            start: "calendar" | "anchor" | "first_use";
+            subject: components["schemas"]["LimitSubject"];
+            /** @example cents */
+            unit: string;
+            /** @example 2026-10-04T12:00:00.000Z */
+            updatedAt: string;
+            /** @description Increases on every change. */
+            version: number;
+            /**
+             * @description `minute`, `hour`, `day`, `week`, `month` or `year`: a period of `every` of them, refilled where `start` says (or rolling: see `rolling`). `total`: a balance that never resets, topped up by grants. `concurrent`: at most `amount` held reservations at once.
+             * @example month
+             * @enum {string}
+             */
+            window: "minute" | "hour" | "day" | "week" | "month" | "year" | "total" | "concurrent";
+        };
+        LimitGrant: {
+            amount: number;
+            createdAt: string;
+            createdByUserId: string | null;
+            /** @example grt_… */
+            id: string;
+            limitId: string;
+            note: string;
+            subject: {
+                id: string;
+                kind: string;
+            };
+        };
+        LimitGrantInput: {
+            /**
+             * @description Credits to add; negative to take them back. Not 0.
+             * @example 5000
+             */
+            amount: number;
+            /**
+             * @description Required when `amount` is negative.
+             * @example October top-up
+             */
+            note?: string;
+            /**
+             * @description Who gets the credits, as `{"kind": "team", "id": "team_42"}`.
+             * @example {
+             *       "kind": "team",
+             *       "id": "team_42"
+             *     }
+             */
+            subject: {
+                id: string;
+                kind: string;
+            };
+        };
+        LimitInput: {
+            /**
+             * @description The action to limit; `*` for every action.
+             * @example ai-call
+             */
+            action: string;
+            /**
+             * @description How many units each subject may use per window.
+             * @example 200
+             */
+            amount: number;
+            /** @description Whether checks enforce it. Default: true. */
+            enabled?: boolean;
+            /**
+             * @description How many `window` units a period lasts: `window: "month", every: 3` is a quarter, `window: "hour", every: 5` five hours. Default: 1.
+             * @example 1
+             */
+            every?: number;
+            /**
+             * @description What your code should do when Limitry can't be reached: `open` (allow) or `closed` (deny). Default: open.
+             * @enum {string}
+             */
+            failMode?: "open" | "closed";
+            /**
+             * @description A name for the limit, unique among its environment's active limits.
+             * @example AI budget
+             */
+            name: string;
+            /** @description Count the last window instead of the calendar one (minute, hour or day only). Default: false. */
+            rolling?: boolean;
+            /**
+             * @description Where a period begins. `calendar`: UTC boundaries (midnight, Monday, the 1st, 1 January). `anchor`: from the subject's anchor, its billing date, set with `subjects.update` (its first check until then), so an annual plan can refill monthly from its start day. `first_use`: at the first check after the previous period ended. Default: calendar.
+             * @example calendar
+             * @enum {string}
+             */
+            start?: "calendar" | "anchor" | "first_use";
+            /** @description One subject; omit or null for every subject of the kind. A subject's own limit replaces the kind's limits with the same action and window. */
+            subjectId?: string | null;
+            /**
+             * @description Your own label for who is checked.
+             * @example user
+             */
+            subjectKind: string;
+            /**
+             * @description What the amount counts (display only). Default: units.
+             * @example cents
+             */
+            unit?: string;
+            /**
+             * @description `minute`, `hour`, `day`, `week`, `month` or `year`: a period of `every` of them, refilled where `start` says (or rolling: see `rolling`). `total`: a balance that never resets, topped up by grants. `concurrent`: at most `amount` held reservations at once.
+             * @example month
+             * @enum {string}
+             */
+            window: "minute" | "hour" | "day" | "week" | "month" | "year" | "total" | "concurrent";
+        };
+        LimitPage: {
+            items: components["schemas"]["Limit"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        LimitPatch: {
+            /**
+             * @description The action to limit; `*` for every action.
+             * @example ai-call
+             */
+            action?: string;
+            /**
+             * @description How many units each subject may use per window.
+             * @example 200
+             */
+            amount?: number;
+            /** @description Whether checks enforce it. Default: true. */
+            enabled?: boolean;
+            /**
+             * @description How many `window` units a period lasts: `window: "month", every: 3` is a quarter, `window: "hour", every: 5` five hours. Default: 1.
+             * @example 1
+             */
+            every?: number;
+            /**
+             * @description What your code should do when Limitry can't be reached: `open` (allow) or `closed` (deny). Default: open.
+             * @enum {string}
+             */
+            failMode?: "open" | "closed";
+            /**
+             * @description A name for the limit, unique among its environment's active limits.
+             * @example AI budget
+             */
+            name?: string;
+            /** @description Count the last window instead of the calendar one (minute, hour or day only). Default: false. */
+            rolling?: boolean;
+            /**
+             * @description Where a period begins. `calendar`: UTC boundaries (midnight, Monday, the 1st, 1 January). `anchor`: from the subject's anchor, its billing date, set with `subjects.update` (its first check until then), so an annual plan can refill monthly from its start day. `first_use`: at the first check after the previous period ended. Default: calendar.
+             * @example calendar
+             * @enum {string}
+             */
+            start?: "calendar" | "anchor" | "first_use";
+            /** @description One subject; omit or null for every subject of the kind. A subject's own limit replaces the kind's limits with the same action and window. */
+            subjectId?: string | null;
+            /**
+             * @description Your own label for who is checked.
+             * @example user
+             */
+            subjectKind?: string;
+            /**
+             * @description What the amount counts (display only). Default: units.
+             * @example cents
+             */
+            unit?: string;
+            /**
+             * @description `minute`, `hour`, `day`, `week`, `month` or `year`: a period of `every` of them, refilled where `start` says (or rolling: see `rolling`). `total`: a balance that never resets, topped up by grants. `concurrent`: at most `amount` held reservations at once.
+             * @example month
+             * @enum {string}
+             */
+            window?: "minute" | "hour" | "day" | "week" | "month" | "year" | "total" | "concurrent";
+        };
+        LimitSubject: {
+            /**
+             * @description One subject, or null for every subject of this kind.
+             * @example null
+             */
+            id: string | null;
+            /**
+             * @description Your own label for who is checked: user, apikey, agent, team …
+             * @example user
+             */
+            kind: string;
+        };
+        LimitSyncInput: {
+            /** @description Archive the environment's active limits whose names aren't in `limits` (restorable). Default: false, which leaves them alone. */
+            archiveMissing?: boolean;
+            /** @description Answer what the sync would do and change nothing. Default: false. */
+            dryRun?: boolean;
+            /**
+             * @description Every limit you want, each described whole: an omitted field is its default, as on create. Names are the key and must be unique in the list. At most 200.
+             * @example [
+             *       {
+             *         "name": "AI budget",
+             *         "subjectKind": "user",
+             *         "action": "ai-call",
+             *         "amount": 200,
+             *         "unit": "cents",
+             *         "window": "month"
+             *       }
+             *     ]
+             */
+            limits: components["schemas"]["LimitInput"][];
+        };
+        LimitSyncResult: {
+            /** @description Names of the limits archived (with `archiveMissing`). */
+            archived: string[];
+            /**
+             * @description Names of the limits created.
+             * @example [
+             *       "AI budget"
+             *     ]
+             */
+            created: string[];
+            /** @description True when nothing was written: this is the plan. */
+            dryRun: boolean;
+            /** @description Names of the limits that already matched. */
+            unchanged: string[];
+            /** @description The limits changed, field by field. */
+            updated: {
+                /**
+                 * @description Each changed field, from its old value to the new.
+                 * @example {
+                 *       "amount": {
+                 *         "from": 200,
+                 *         "to": 300
+                 *       }
+                 *     }
+                 */
+                changes: {
+                    [key: string]: {
+                        from: string | number | boolean | null;
+                        to: string | number | boolean | null;
+                    };
+                };
+                name: string;
+            }[];
+        };
+        Member: {
+            email: string;
+            /** @description The membership's id. */
+            id: string;
+            /** @example 2026-08-19T12:00:00.000Z */
+            joinedAt: string;
+            name: string;
+            /**
+             * @description `owner`, `admin`, `member` or `guest`.
+             * @example member
+             */
+            role: string;
+            userId: string;
+        };
+        MemberPage: {
+            items: components["schemas"]["Member"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        Reservation: {
+            /** @description What it finally used: the committed cost; 0 when released. */
+            cost: number;
+            expiresAt: string;
+            id: string;
+            /** @description The amount held. */
+            reserved: number;
+            /**
+             * @description `expired`: nobody settled it in time, so it gave its hold back.
+             * @enum {string}
+             */
+            status: "held" | "committed" | "released" | "expired";
+        };
+        ReservationCommit: {
+            /**
+             * @description The amount actually used.
+             * @example 3
+             */
+            cost: number;
+        };
+        ReservationExtend: {
+            /**
+             * @description Seconds from now. Default 300.
+             * @example 600
+             */
+            ttlSeconds?: number;
+        };
+        Subject: {
+            /**
+             * @description When its `anchor` limits' periods start from: its billing date, else its first counted check. Null until it has one.
+             * @example 2026-03-17T14:30:00.000Z
+             */
+            anchor: string | null;
+            subject: components["schemas"]["SubjectRef"];
+        };
+        SubjectRef: {
+            id: string;
+            kind: string;
+        };
+        SubjectReset: {
+            /**
+             * @description Just this limit. Default: every limit on the subject.
+             * @example lim_3f0c…
+             */
+            limitId?: string;
+        };
+        SubjectResetResult: {
+            /** @description The limits that were refilled. */
+            reset: string[];
+            subject: components["schemas"]["SubjectRef"];
+        };
+        SubjectUpdate: {
+            /**
+             * Format: date-time
+             * @description The date and time its periods start from (ISO 8601), such as a subscription's start.
+             * @example 2026-03-17T14:30:00Z
+             */
+            anchor: string;
+        };
+        Team: {
+            /** @example 2026-08-19T12:00:00.000Z */
+            createdAt: string;
+            id: string;
+            /** @description The team every member (not guests) belongs to. */
+            isDefault: boolean;
+            /** @description The user ids of the team's members. */
+            memberIds: string[];
+            name: string;
+        };
+        TeamPage: {
+            items: components["schemas"]["Team"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        UsageBySubject: {
+            items: {
+                denied: number;
+                over: boolean;
+                remaining: number;
+                subject: {
+                    id: string;
+                    kind: string;
+                };
+                used: number;
+            }[];
+            limitId: string;
+            windowStart: string;
+        };
+        UsageSeries: {
+            /** @enum {string} */
+            granularity: "hour" | "day";
+            limitId: string;
+            points: {
+                allowed: number;
+                denied: number;
+                start: string;
+                used: number;
+            }[];
+        };
+        UsageStanding: {
+            /** @example live */
+            environment: string;
+            limits: {
+                action: string;
+                amount: number;
+                limit: string;
+                name: string;
+                /** @description A balance's can exceed `amount` once credits are granted. */
+                remaining: number;
+                resetsAt: string | null;
+                rolling: boolean;
+                /** @description On a shared subject, not this one. */
+                shared: boolean;
+                subject: {
+                    id: string;
+                    kind: string;
+                };
+                unit: string;
+                used: number;
+                /** @enum {string} */
+                window: "minute" | "hour" | "day" | "week" | "month" | "year" | "total" | "concurrent";
+            }[];
+            subject: {
+                id: string;
+                kind: string;
+            };
+        };
+        UserMe: {
+            /** @example casey@example.com */
+            email: string;
+            /** @example k3TAiF2ZP5sQxWbVJd8mR1cyNGuh4Eo9 */
+            id: string;
+            /** @example Casey Customer */
+            name: string;
+            workspaces: {
+                id: string;
+                /** @example Acme Inc. */
+                name: string;
+                /** @example owner */
+                role: string;
+                /** @example acme */
+                slug: string;
+            }[];
+        };
+        WebhookDelivery: {
+            attempts: number;
+            createdAt: string;
+            /** @example evt_51c2… */
+            eventId: string;
+            /** @example workspace.member.joined */
+            eventType: string;
+            /** @example del_8a1b… */
+            id: string;
+            lastAttemptAt: string | null;
+            lastStatus: number | null;
+            /**
+             * @description `pending`, `delivered` or `failed`.
+             * @example delivered
+             */
+            status: string;
+        };
+        WebhookDeliveryOutcome: {
+            deliveryId: string;
+            /** @description When attempted immediately: whether it was accepted. */
+            ok?: boolean;
+            /** @description True when queued for delivery (with retries); false when attempted immediately. */
+            queued: boolean;
+            status?: number | null;
+        };
+        WebhookDeliveryPage: {
+            items: components["schemas"]["WebhookDelivery"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        WebhookEndpoint: {
+            consecutiveFailures: number;
+            createdAt: string;
+            description: string | null;
+            /** @description False after 20 failed attempts in a row (retries count); re-enable to resume. */
+            enabled: boolean;
+            /**
+             * @description The environment it belongs to, where the product has them: it receives only that environment's events and is managed with a credential acting in it. Null otherwise.
+             * @example live
+             */
+            environment: string | null;
+            /** @description The event types it receives (see event-types); null = every event. */
+            eventTypes: string[] | null;
+            /** @example we_3f0c… */
+            id: string;
+            lastAttemptAt: string | null;
+            lastStatus: number | null;
+            /** @example https://example.com/hooks */
+            url: string;
+        };
+        WebhookEndpointCreated: {
+            endpoint: components["schemas"]["WebhookEndpoint"];
+            secret: string;
+        };
+        WebhookEndpointPage: {
+            items: components["schemas"]["WebhookEndpoint"][];
+            /** @description Pass as ?cursor= to fetch the next page. */
+            nextCursor: string | null;
+        };
+        Workspace: {
+            /** @example k3TAiF2ZP5sQxWbVJd8mR1cyNGuh4Eo9 */
+            id: string;
+            /** @example Acme Inc. */
+            name: string;
+        };
+        WorkspaceUsage: {
+            meters: {
+                description: string;
+                /** @example webhook_deliveries */
+                id: string;
+                /** @description The plan's limit this period; null = unlimited. */
+                limit: number | null;
+                used: number;
+            }[];
+            /** @description Things to know about these numbers, such as some usage being unavailable right now. */
+            notices?: string[];
+            /**
+             * @description When the counts reset.
+             * @example 2026-11-17T14:30:00.000Z
+             */
+            periodEnd: string;
+            /**
+             * @description When this period began: a month after the last, from the billing date.
+             * @example 2026-10-17T14:30:00.000Z
+             */
+            periodStart: string;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    "checks.create": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CheckRequest"];
+            };
+        };
+        responses: {
+            /** @description The decision — allowed or not. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CheckDecision"];
+                };
+            };
+            /** @description Invalid request (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description The workspace is more than 10% past its plan's monthly allowed checks or active subjects (code: plan_limit_reached): no decision — apply the limit's fail mode, as when Limitry is unreachable. The SDK does this for you. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description This Idempotency-Key was used for a different check (code: idempotency_key_reused). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.list": {
+        parameters: {
+            query?: {
+                /** @description Only this action. */
+                action?: string;
+                /** @description `true`: the archived limits instead. */
+                archived?: "true" | "false";
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+                /** @description Only this kind. */
+                subjectKind?: string;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of limits. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LimitPage"];
+                };
+            };
+            /** @description Malformed cursor or query (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.create": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LimitInput"];
+            };
+        };
+        responses: {
+            /** @description The new limit. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Limit"];
+                };
+            };
+            /** @description Invalid request, such as a duplicate name (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.get": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The limit. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Limit"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.update": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LimitPatch"];
+            };
+        };
+        responses: {
+            /** @description The changed limit. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Limit"];
+                };
+            };
+            /** @description Invalid request, such as a duplicate name (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.archive": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Archived. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.grants.list": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The grants. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["LimitGrant"][];
+                    };
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.grants.create": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LimitGrantInput"];
+            };
+        };
+        responses: {
+            /** @description The grant — the balance is raised. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LimitGrant"];
+                };
+            };
+            /** @description Invalid request, such as a duplicate name (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.restore": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                limitId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The restored limit. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Limit"];
+                };
+            };
+            /** @description Invalid request, such as a duplicate name (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "limits.sync": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LimitSyncInput"];
+            };
+        };
+        responses: {
+            /** @description What changed, or with `dryRun`, what would. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LimitSyncResult"];
+                };
+            };
+            /** @description Something in the list is invalid, such as a name twice; nothing was changed (code: invalid_request, each problem in `details`). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "reservations.commit": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                reservationId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ReservationCommit"];
+            };
+        };
+        responses: {
+            /** @description The reservation, settled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Reservation"];
+                };
+            };
+            /** @description Already settled the other way, or an invalid cost (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such reservation in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "reservations.extend": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                reservationId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["ReservationExtend"];
+            };
+        };
+        responses: {
+            /** @description The reservation, settled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Reservation"];
+                };
+            };
+            /** @description Already settled the other way, or an invalid cost (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such reservation in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "reservations.release": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                reservationId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The reservation, settled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Reservation"];
+                };
+            };
+            /** @description Already settled the other way, or an invalid cost (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such reservation in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "subjects.get": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                subjectId: string;
+                subjectKind: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The subject. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Subject"];
+                };
+            };
+            /** @description Unknown environment (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "subjects.update": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                subjectId: string;
+                subjectKind: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SubjectUpdate"];
+            };
+        };
+        responses: {
+            /** @description The subject, with its new anchor. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Subject"];
+                };
+            };
+            /** @description Invalid anchor (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "subjects.reset": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                subjectId: string;
+                subjectKind: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SubjectReset"];
+            };
+        };
+        responses: {
+            /** @description What was reset. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SubjectResetResult"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit on this subject (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "usage.query": {
+        parameters: {
+            query: {
+                /** @description Start of the range (ISO 8601). Default: 30 days before `to`. */
+                from?: string;
+                /** @description One bucket per `hour` or per `day` (UTC). Default: day. */
+                granularity?: "hour" | "day";
+                /** @description The limit. */
+                limitId: string;
+                /** @description With `subjectKind`: one subject's usage. */
+                subjectId?: string;
+                /** @description With `subjectId`: one subject's usage, not every subject's. */
+                subjectKind?: string;
+                /** @description End of the range (ISO 8601). Default: now. */
+                to?: string;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The series. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UsageSeries"];
+                };
+            };
+            /** @description Invalid range (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "usage.standing": {
+        parameters: {
+            query: {
+                /** @description The subject's id, as your checks send it. */
+                id: string;
+                /** @description The subject's kind, as your checks send it. */
+                kind: string;
+                /** @description Shared subjects to include, comma-separated `kind:id` (up to 4). */
+                shared?: string;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Where the subject stands. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UsageStanding"];
+                };
+            };
+            /** @description Invalid subject (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Checks are unavailable (code: internal_error). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "usage.subjects": {
+        parameters: {
+            query: {
+                /** @description How many subjects, most used first: 1–200. Default 50. */
+                limit?: number;
+                /** @description The limit. */
+                limitId: string;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The subjects. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UsageBySubject"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such limit (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "user.me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The user the token authenticates. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UserMe"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Personal access tokens are disabled in this deployment (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "user.revokeToken": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Revoked. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Personal access tokens are disabled in this deployment (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.get": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The Workspace the key authenticates. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.approvalActions.list": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The approvable actions. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: {
+                            approverRoles: string[];
+                            createsSecret: boolean;
+                            id: string;
+                            input: {
+                                [key: string]: unknown;
+                            };
+                            title: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.approvalRequests.create": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description An action id from approval-actions.
+                     * @example workspace.apiKey.create
+                     */
+                    action: string;
+                    /**
+                     * @description The action's input, per its JSON Schema.
+                     * @example {
+                     *       "name": "acme-web",
+                     *       "scopes": [
+                     *         "workspace:read"
+                     *       ]
+                     *     }
+                     */
+                    input: {
+                        [key: string]: unknown;
+                    };
+                    /** @description Why — the person reads it before deciding. */
+                    reason: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The request, pending. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalRequest"];
+                };
+            };
+            /** @description Unknown action or invalid input (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.approvalRequests.get": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                /** @description The request's id. */
+                requestId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The request. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalRequest"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Not one of yours (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.approvalRequests.redeem": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                /** @description The request's id. */
+                requestId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Done; the secret, once. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        envVar: string | null;
+                        request: components["schemas"]["ApprovalRequest"];
+                        secret: string | null;
+                    };
+                };
+            };
+            /** @description Not approved, already redeemed or expired (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Not yours (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.auditEvents.list": {
+        parameters: {
+            query?: {
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of audit events, newest first. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuditEventPage"];
+                };
+            };
+            /** @description Malformed cursor or query (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.eventTypes.list": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The event types. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: {
+                            description: string;
+                            /** @example workspace.member.joined */
+                            type: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.invitations.list": {
+        parameters: {
+            query?: {
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of pending invitations, newest first. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InvitationPage"];
+                };
+            };
+            /** @description Malformed cursor or query (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.members.list": {
+        parameters: {
+            query?: {
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of members, newest first. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MemberPage"];
+                };
+            };
+            /** @description Malformed cursor or query (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.teams.list": {
+        parameters: {
+            query?: {
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of teams, newest first. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TeamPage"];
+                };
+            };
+            /** @description Malformed cursor or query (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.usage": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description This period's usage. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceUsage"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.list": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The endpoints. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointPage"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.create": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description A note for people managing the endpoint. */
+                    description?: string;
+                    /**
+                     * @description Only these event types (see event-types); omit for every event.
+                     * @example [
+                     *       "workspace.member.joined"
+                     *     ]
+                     */
+                    eventTypes?: string[];
+                    /**
+                     * @description The https URL that receives the events.
+                     * @example https://example.com/hooks
+                     */
+                    url: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The endpoint and its signing secret (shown once). */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointCreated"];
+                };
+            };
+            /** @description Invalid request (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.get": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The endpoint. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.delete": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Removed. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookDeliveries.list": {
+        parameters: {
+            query?: {
+                /** @description Opaque token from a previous page's nextCursor. */
+                cursor?: string;
+                /** @description Items per page, 1–100 (default 25). */
+                limit?: number;
+            };
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of deliveries. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryPage"];
+                };
+            };
+            /** @description Invalid request (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookDeliveries.redeliver": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                deliveryId: string;
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The redelivery was sent or queued. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryOutcome"];
+                };
+            };
+            /** @description Invalid request (code: invalid_request). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.enable": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The re-enabled endpoint. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    "workspace.webhookEndpoints.test": {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The environment the request acts in; without it, the product's default. An API key bound to an environment always acts in its own (403 naming another); an unknown environment is 400. */
+                "x-environment"?: string;
+                /** @description Workspace slug. REQUIRED when authenticating with a personal access token (400 without it); ignored for API keys. */
+                "x-workspace"?: string;
+            };
+            path: {
+                endpointId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The test delivery was sent or queued. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryOutcome"];
+                };
+            };
+            /** @description Missing, malformed, invalid, revoked, or expired credential — API key or personal access token (code: unauthorized). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description A personal access token that cannot act in the named workspace (unknown slug, not a member, or excluded by the token's scopes), is not granted this route's scope, or lacks the workspace role the route requires (code: forbidden). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description No such endpoint (or delivery) in this workspace (code: not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Per-key quota exhausted (code: rate_limited); retry after the Retry-After header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+}