@logto/api 1.41.0 → 1.42.0

package/lib/generated-types/management.d.ts

@@ -223,9 +223,7 @@ export interface paths {
         post?: never;
         /**
          * Delete application legacy secret
-         * @description Delete the legacy secret for the application and replace it with a new internal secret.
-         *
-         *     Note: This operation does not "really" delete the legacy secret because it is still needed for internal validation. We may remove the display of the legacy secret (the `secret` field in the application response) in the future.
+         * @description Delete the legacy secret for the application and replace it with an internal secret used only by Logto. The internal secret is not returned by Management APIs and cannot be used for client authentication.
          */
         delete: operations["DeleteApplicationLegacySecret"];
         options?: never;
@@ -611,6 +609,78 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/configs/actions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get all actions
+         * @description Get all action configurations for the tenant.
+         */
+        get: operations["ListActions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/configs/actions/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Test action
+         * @description Test an action script with a sample context.
+         */
+        post: operations["TestAction"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/configs/actions/{actionType}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get action
+         * @description Get the action configuration for the given action type.
+         */
+        get: operations["GetAction"];
+        /**
+         * Create or update action
+         * @description Create or update an action configuration for the given action type.
+         */
+        put: operations["UpsertAction"];
+        post?: never;
+        /**
+         * Delete action
+         * @description Delete the action configuration for the given action type.
+         */
+        delete: operations["DeleteAction"];
+        options?: never;
+        head?: never;
+        /**
+         * Update action
+         * @description Update the action configuration for the given action type.
+         */
+        patch: operations["UpdateAction"];
+        trace?: never;
+    };
     "/api/connectors": {
         parameters: {
             query?: never;
@@ -2111,6 +2181,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/domains/{id}/verification-files": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get domain verification files
+         * @description Get the verification files served from the custom domain.
+         */
+        get: operations["ListDomainVerificationFiles"];
+        /**
+         * Replace domain verification files
+         * @description Replace the verification files served from the custom domain.
+         */
+        put: operations["ReplaceDomainVerificationFiles"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/domains/cleanup": {
         parameters: {
             query?: never;
@@ -3752,7 +3846,7 @@ export interface components {
         Translation: string;
         /**
          * @deprecated
-         * @description The internal client secret. Note it is only used for internal validation, and the actual secrets should be retrieved from `/api/applications/{id}/secrets` endpoints.
+         * @description The legacy client secret. This field is omitted after the legacy secret has been replaced by an internal secret. Retrieve current application secrets from the `/api/applications/{id}/secrets` endpoints.
          */
         ApplicationLegacySecret: string;
         SamlApplicationResponse: {
@@ -3927,7 +4021,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: components["schemas"]["ApplicationLegacySecret"];
+                        secret?: components["schemas"]["ApplicationLegacySecret"];
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -4083,7 +4177,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: components["schemas"]["ApplicationLegacySecret"];
+                        secret?: components["schemas"]["ApplicationLegacySecret"];
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -4211,7 +4305,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: components["schemas"]["ApplicationLegacySecret"];
+                        secret?: components["schemas"]["ApplicationLegacySecret"];
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -4436,7 +4530,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: components["schemas"]["ApplicationLegacySecret"];
+                        secret?: components["schemas"]["ApplicationLegacySecret"];
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -5326,7 +5420,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description OK */
+            /** @description The legacy secret was deleted successfully. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -5336,7 +5430,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: string;
+                        secret?: string;
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -5405,13 +5499,6 @@ export interface operations {
                     };
                 };
             };
-            /** @description The legacy secret was deleted successfully. */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
             /** @description The application does not have a legacy secret. */
             400: {
                 headers: {
@@ -7081,6 +7168,8 @@ export interface operations {
                                     };
                                     oneTimeTokenContext?: {
                                         jitOrganizationIds?: string[];
+                                        /** @enum {string} */
+                                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                     };
                                 } | {
                                     id: string;
@@ -7577,6 +7666,8 @@ export interface operations {
                                     };
                                     oneTimeTokenContext?: {
                                         jitOrganizationIds?: string[];
+                                        /** @enum {string} */
+                                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                     };
                                 } | {
                                     id: string;
@@ -8016,6 +8107,8 @@ export interface operations {
                                     };
                                     oneTimeTokenContext?: {
                                         jitOrganizationIds?: string[];
+                                        /** @enum {string} */
+                                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                     };
                                 } | {
                                     id: string;
@@ -8554,6 +8647,8 @@ export interface operations {
                                     };
                                     oneTimeTokenContext?: {
                                         jitOrganizationIds?: string[];
+                                        /** @enum {string} */
+                                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                     };
                                 } | {
                                     id: string;
@@ -9035,6 +9130,8 @@ export interface operations {
                                         };
                                         oneTimeTokenContext?: {
                                             jitOrganizationIds?: string[];
+                                            /** @enum {string} */
+                                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                         };
                                     } | {
                                         id: string;
@@ -9527,6 +9624,8 @@ export interface operations {
                                 };
                                 oneTimeTokenContext?: {
                                     jitOrganizationIds?: string[];
+                                    /** @enum {string} */
+                                    interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                 };
                             } | {
                                 id: string;
@@ -9709,44 +9808,436 @@ export interface operations {
                             createdAt?: number;
                         };
                     };
-                });
+                });
+            };
+        };
+        responses: {
+            /** @description The result of the JWT customizer script testing. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            /** @description Zod errors in cloud service (data type does not match expectation, can be either request body or response body). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Cloud connection does not have enough permission to perform the action. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Syntax errors in cloud service. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    GetIdTokenConfig: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The ID token claims configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Configuration not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    UpsertIdTokenConfig: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description An array of extended claims to include in ID tokens. Possible values: `custom_data`, `identities`, `sso_identities`, `roles`, `organizations`, `organization_data`, `organization_roles`. */
+                    enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
+                };
+            };
+        };
+        responses: {
+            /** @description The updated ID token claims configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
+                    };
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The tenant's subscription plan does not support this feature. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    ListActions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The action configurations. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        key: "action.postFirstFactorVerification" | "action.postSignIn";
+                        value: {
+                            script: string;
+                            environmentVariables?: {
+                                [key: string]: string;
+                            };
+                            contextSample?: ({
+                                [key: string]: unknown;
+                            } | (string | number | boolean | (string | null) | {
+                                [key: string]: unknown;
+                            })[] | string | number | boolean) | null;
+                            enabled?: boolean;
+                            /** @enum {string} */
+                            onExecutionError?: "block" | "allow";
+                        };
+                    }[];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    TestAction: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The action script to test. */
+                    script: string;
+                    /**
+                     * @description The action type to test.
+                     * @enum {string}
+                     */
+                    actionType: "action.postFirstFactorVerification" | "action.postSignIn";
+                    /** @description The sample event for action script testing. */
+                    event: ({
+                        [key: string]: unknown;
+                    } | (string | number | boolean | (string | null) | {
+                        [key: string]: unknown;
+                    })[] | string | number | boolean) | null;
+                    /** @description The environment variables for the action script. */
+                    environmentVariables?: {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description The result of the action script testing. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": ({
+                        [key: string]: unknown;
+                    } | (string | number | boolean | (string | null) | {
+                        [key: string]: unknown;
+                    })[] | string | number | boolean) | null;
+                };
+            };
+            /** @description The action script returned no result. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The request body or response body is invalid. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Cloud connection does not have enough permission to perform the action or the tenant's subscription plan does not support this feature. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The action script failed to execute. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    GetAction: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The action type to get. */
+                actionType: "action.postFirstFactorVerification" | "action.postSignIn";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The action configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        script: string;
+                        environmentVariables?: {
+                            [key: string]: string;
+                        };
+                        contextSample?: ({
+                            [key: string]: unknown;
+                        } | (string | number | boolean | (string | null) | {
+                            [key: string]: unknown;
+                        })[] | string | number | boolean) | null;
+                        enabled?: boolean;
+                        /** @enum {string} */
+                        onExecutionError?: "block" | "allow";
+                    };
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The action configuration does not exist. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    UpsertAction: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The action type to create or update. */
+                actionType: "action.postFirstFactorVerification" | "action.postSignIn";
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The action script. */
+                    script: string;
+                    /** @description The environment variables for the action script. */
+                    environmentVariables?: {
+                        [key: string]: string;
+                    };
+                    /** @description The sample context for action script testing. */
+                    contextSample?: ({
+                        [key: string]: unknown;
+                    } | (string | number | boolean | (string | null) | {
+                        [key: string]: unknown;
+                    })[] | string | number | boolean) | null;
+                    /** @description Whether the action is enabled. */
+                    enabled?: boolean;
+                    /**
+                     * @description The action execution error handling policy.
+                     * @enum {string}
+                     */
+                    onExecutionError?: "block" | "allow";
+                };
             };
         };
         responses: {
-            /** @description The result of the JWT customizer script testing. */
+            /** @description The updated action configuration. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        [key: string]: unknown;
+                        script: string;
+                        environmentVariables?: {
+                            [key: string]: string;
+                        };
+                        contextSample?: ({
+                            [key: string]: unknown;
+                        } | (string | number | boolean | (string | null) | {
+                            [key: string]: unknown;
+                        })[] | string | number | boolean) | null;
+                        enabled?: boolean;
+                        /** @enum {string} */
+                        onExecutionError?: "block" | "allow";
                     };
                 };
             };
-            /** @description Zod errors in cloud service (data type does not match expectation, can be either request body or response body). */
-            400: {
+            /** @description The created action configuration. */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        script: string;
+                        environmentVariables?: {
+                            [key: string]: string;
+                        };
+                        contextSample?: ({
+                            [key: string]: unknown;
+                        } | (string | number | boolean | (string | null) | {
+                            [key: string]: unknown;
+                        })[] | string | number | boolean) | null;
+                        enabled?: boolean;
+                        /** @enum {string} */
+                        onExecutionError?: "block" | "allow";
+                    };
+                };
             };
-            /** @description Unauthorized */
-            401: {
+            /** @description The request body is invalid. */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Cloud connection does not have enough permission to perform the action. */
-            403: {
+            /** @description Unauthorized */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Syntax errors in cloud service. */
-            422: {
+            /** @description The tenant's subscription plan does not support this feature. */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -9754,25 +10245,31 @@ export interface operations {
             };
         };
     };
-    GetIdTokenConfig: {
+    DeleteAction: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                /** @description The action type to delete. */
+                actionType: "action.postFirstFactorVerification" | "action.postSignIn";
+            };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description The ID token claims configuration. */
-            200: {
+            /** @description The action configuration was deleted successfully. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
-                    };
+                content?: never;
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
                 };
+                content?: never;
             };
             /** @description Unauthorized */
             401: {
@@ -9788,7 +10285,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Configuration not found. */
+            /** @description The action configuration does not exist. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -9797,34 +10294,65 @@ export interface operations {
             };
         };
     };
-    UpsertIdTokenConfig: {
+    UpdateAction: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                /** @description The action type to update. */
+                actionType: "action.postFirstFactorVerification" | "action.postSignIn";
+            };
             cookie?: never;
         };
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description An array of extended claims to include in ID tokens. Possible values: `custom_data`, `identities`, `sso_identities`, `roles`, `organizations`, `organization_data`, `organization_roles`. */
-                    enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
+                    /** @description The action script. */
+                    script?: string;
+                    /** @description The environment variables for the action script. */
+                    environmentVariables?: {
+                        [key: string]: string;
+                    };
+                    /** @description The sample context for action script testing. */
+                    contextSample?: ({
+                        [key: string]: unknown;
+                    } | (string | number | boolean | (string | null) | {
+                        [key: string]: unknown;
+                    })[] | string | number | boolean) | null;
+                    /** @description Whether the action is enabled. */
+                    enabled?: boolean;
+                    /**
+                     * @description The action execution error handling policy.
+                     * @enum {string}
+                     */
+                    onExecutionError?: "block" | "allow";
                 };
             };
         };
         responses: {
-            /** @description The updated ID token claims configuration. */
+            /** @description The updated action configuration. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[];
+                        script: string;
+                        environmentVariables?: {
+                            [key: string]: string;
+                        };
+                        contextSample?: ({
+                            [key: string]: unknown;
+                        } | (string | number | boolean | (string | null) | {
+                            [key: string]: unknown;
+                        })[] | string | number | boolean) | null;
+                        enabled?: boolean;
+                        /** @enum {string} */
+                        onExecutionError?: "block" | "allow";
                     };
                 };
             };
-            /** @description Bad Request */
+            /** @description The request body is invalid. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -9845,6 +10373,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description The action configuration does not exist. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     ListConnectors: {
@@ -11769,15 +12304,16 @@ export interface operations {
                             maxAttempts?: number;
                             lockoutDuration?: number;
                         };
-                        /** @description Define email restriction policies. Users will be prohibited from registering or linking any email addresses that are included in the blocklist. */
+                        /** @description Define email restriction policies for registering or linking email addresses. */
                         emailBlocklistPolicy: {
+                            /** @description Cloud only.  Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. */
                             blockDisposableAddresses?: boolean;
                             /** @description Whether to block sub-addresses. (E.g., example+shopping@test.com) */
                             blockSubaddressing?: boolean;
-                            /** @description Custom blocklist of email addresses or domains. */
+                            /** @description Custom allowlist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`. */
+                            customAllowlist?: string[];
+                            /** @description Custom blocklist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`. */
                             customBlocklist?: string[];
-                            /** @description Cloud only.  Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. */
-                            blockDisposableAddress?: unknown;
                         };
                         verificationCodePolicy: {
                             expirationDuration?: number;
@@ -11973,15 +12509,16 @@ export interface operations {
                         maxAttempts?: number;
                         lockoutDuration?: number;
                     };
-                    /** @description Define email restriction policies. Users will be prohibited from registering or linking any email addresses that are included in the blocklist. */
+                    /** @description Define email restriction policies for registering or linking email addresses. */
                     emailBlocklistPolicy?: {
+                        /** @description Cloud only.  Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. */
                         blockDisposableAddresses?: boolean;
                         /** @description Whether to block sub-addresses. (E.g., example+shopping@test.com) */
                         blockSubaddressing?: boolean;
-                        /** @description Custom blocklist of email addresses or domains. */
+                        /** @description Custom allowlist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`. */
+                        customAllowlist?: string[];
+                        /** @description Custom blocklist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`. */
                         customBlocklist?: string[];
-                        /** @description Cloud only.  Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. */
-                        blockDisposableAddress?: unknown;
                     };
                     forgotPasswordMethods?: ("EmailVerificationCode" | "PhoneVerificationCode")[] | null;
                     passkeySignIn?: {
@@ -12149,6 +12686,7 @@ export interface operations {
                         emailBlocklistPolicy: {
                             blockDisposableAddresses?: boolean;
                             blockSubaddressing?: boolean;
+                            customAllowlist?: string[];
                             customBlocklist?: string[];
                         };
                         verificationCodePolicy: {
@@ -15640,6 +16178,8 @@ export interface operations {
                                     };
                                     oneTimeTokenContext?: {
                                         jitOrganizationIds?: string[];
+                                        /** @enum {string} */
+                                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                     };
                                 } | {
                                     id: string;
@@ -15864,6 +16404,8 @@ export interface operations {
                                 };
                                 oneTimeTokenContext?: {
                                     jitOrganizationIds?: string[];
+                                    /** @enum {string} */
+                                    interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                                 };
                             } | {
                                 id: string;
@@ -15994,9 +16536,9 @@ export interface operations {
                 logKey?: string;
                 /** @description When `true`, short-circuits the underlying `count(*)` query: any tenant with more than 10,000 matching logs saturates `Total-Number` at the sentinel value `10001` and the response emits `Total-Number-Is-Capped: true`. The `Link` header then omits `rel="last"` and `rel="next"` because the real total is unknown. Default `false`; recommended `true` for any client whose tenant volume may exceed 10,000 matching logs to avoid `statement_timeout`. */
                 enableCap?: string;
-                /** @description Exclusive lower bound on `createdAt`, in unix milliseconds. When set, returns only logs where `createdAt > start_time`. Recommended for clients paginating across very large log ranges to keep query latency consistent. */
+                /** @description Inclusive lower bound on `createdAt`, in unix milliseconds. When set, returns only logs where `createdAt >= start_time`. Recommended for clients paginating across very large log ranges to keep query latency consistent. Because the bound is inclusive, when resuming pagination from the last fetched log, pass its `createdAt + 1` as `start_time` (or de-duplicate by log `id`) to avoid re-fetching the boundary log. */
                 start_time?: string;
-                /** @description Exclusive upper bound on `createdAt`, in unix milliseconds. When set, returns only logs where `createdAt < end_time`. Returns `400` if `start_time >= end_time` when both are present. */
+                /** @description Inclusive upper bound on `createdAt`, in unix milliseconds. When set, returns only logs where `createdAt <= end_time`. Returns `400` if `start_time > end_time` when both are present. */
                 end_time?: string;
                 /** @description Page number (starts from 1). */
                 page?: number;
@@ -16070,7 +16612,7 @@ export interface operations {
                     }[];
                 };
             };
-            /** @description Returned when `start_time` or `end_time` is not a finite number, or when `start_time >= end_time`. */
+            /** @description Returned when `start_time` or `end_time` is not a finite number, or when `start_time > end_time`. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -16799,7 +17341,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: string;
+                        secret?: string;
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -17605,8 +18147,8 @@ export interface operations {
                         id: string;
                         name: string;
                         /** @enum {string|null} */
-                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
-                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
+                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                         config: {
                             url: string;
                             headers?: {
@@ -17665,9 +18207,9 @@ export interface operations {
                      * @description Use `events` instead.
                      * @enum {string}
                      */
-                    event?: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited";
+                    event?: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded";
                     /** @description An array of hook events. */
-                    events?: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                    events?: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                     config: {
                         url: string;
                         headers?: {
@@ -17696,8 +18238,8 @@ export interface operations {
                         id: string;
                         name: string;
                         /** @enum {string|null} */
-                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
-                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
+                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                         config: {
                             url: string;
                             headers?: {
@@ -17760,8 +18302,8 @@ export interface operations {
                         id: string;
                         name: string;
                         /** @enum {string|null} */
-                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
-                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
+                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                         config: {
                             url: string;
                             headers?: {
@@ -17879,9 +18421,9 @@ export interface operations {
                      * @description Use `events` instead.
                      * @enum {string|null}
                      */
-                    event?: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
+                    event?: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
                     /** @description An array of updated hook events. */
-                    events?: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                    events?: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                     config?: {
                         url: string;
                         headers?: {
@@ -17910,8 +18452,8 @@ export interface operations {
                         id: string;
                         name: string;
                         /** @enum {string|null} */
-                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
-                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
+                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                         config: {
                             url: string;
                             headers?: {
@@ -17962,9 +18504,9 @@ export interface operations {
                 logKey?: string;
                 /** @description When `true`, short-circuits the underlying `count(*)` query: results with more than 10,000 matching logs saturate `Total-Number` at the sentinel `10001` and emit `Total-Number-Is-Capped: true`; the `Link` header omits `rel="last"` and `rel="next"`. Default `false`. (This endpoint is already scoped to a single hook over the last 24 hours, so the cap rarely triggers in practice.) */
                 enableCap?: string;
-                /** @description Exclusive lower bound on `createdAt`, in unix milliseconds. Supplying either `start_time` or `end_time` replaces the endpoint's default 24-hour lower bound, so callers can query an arbitrary historical window. Returns `400` if `start_time >= end_time` when both are present. */
+                /** @description Inclusive lower bound on `createdAt`, in unix milliseconds. Supplying either `start_time` or `end_time` replaces the endpoint's default 24-hour lower bound, so callers can query an arbitrary historical window. Returns `400` if `start_time > end_time` when both are present. */
                 start_time?: string;
-                /** @description Exclusive upper bound on `createdAt`, in unix milliseconds. Supplying either `start_time` or `end_time` replaces the endpoint's default 24-hour lower bound. */
+                /** @description Inclusive upper bound on `createdAt`, in unix milliseconds. Supplying either `start_time` or `end_time` replaces the endpoint's default 24-hour lower bound. */
                 end_time?: string;
                 /** @description Page number (starts from 1). */
                 page?: number;
@@ -18040,7 +18582,7 @@ export interface operations {
                     }[];
                 };
             };
-            /** @description Returned when `start_time` or `end_time` is not a finite number, or when `start_time >= end_time`. */
+            /** @description Returned when `start_time` or `end_time` is not a finite number, or when `start_time > end_time`. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -18077,7 +18619,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description An array of hook events for testing. */
-                    events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                    events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                     /** @description The hook configuration for testing. */
                     config: {
                         url: string;
@@ -18166,8 +18708,8 @@ export interface operations {
                         id: string;
                         name: string;
                         /** @enum {string|null} */
-                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | null;
-                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited")[];
+                        event: "PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | null;
+                        events: ("PostRegister" | "PostSignIn" | "PostSignInAdaptiveMfaTriggered" | "PostResetPassword" | "User.Created" | "User.Deleted" | "User.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Created" | "Role.Deleted" | "Role.Data.Updated" | "Role.Scopes.Updated" | "Scope.Created" | "Scope.Deleted" | "Scope.Data.Updated" | "Organization.Created" | "Organization.Deleted" | "Organization.Data.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationRole.Data.Updated" | "OrganizationRole.Scopes.Updated" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "OrganizationScope.Data.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded")[];
                         config: {
                             url: string;
                             headers?: {
@@ -18632,6 +19174,121 @@ export interface operations {
             };
         };
     };
+    ListDomainVerificationFiles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The unique identifier of the domain. */
+                id: components["parameters"]["domainId-root"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The configured domain verification files. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The domain with the specified ID was not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    ReplaceDomainVerificationFiles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The unique identifier of the domain. */
+                id: components["parameters"]["domainId-root"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Up to 10 text or JSON verification files served as filenames with extensions at the domain root, or at paths under `/.well-known/`. */
+                    verificationFiles: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description The domain verification files were replaced successfully. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            /** @description Validation error. Please check the request body. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The domain with the specified ID was not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     CleanupDomains: {
         parameters: {
             query?: never;
@@ -20375,6 +21032,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Unprocessable Content */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     GetOrganization: {
@@ -20619,6 +21283,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Unprocessable Content */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     ListOrganizationUsers: {
@@ -21306,7 +21977,7 @@ export interface operations {
                         tenantId: string;
                         id: string;
                         name: string;
-                        secret: components["schemas"]["ApplicationLegacySecret"];
+                        secret?: components["schemas"]["ApplicationLegacySecret"];
                         description: string | null;
                         /** @enum {string} */
                         type: "Native" | "SPA" | "Traditional" | "MachineToMachine" | "Protected" | "SAML";
@@ -24497,6 +25168,8 @@ export interface operations {
                         token: string;
                         context: {
                             jitOrganizationIds?: string[];
+                            /** @enum {string} */
+                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                         };
                         /** @enum {string} */
                         status: "active" | "consumed" | "revoked" | "expired";
@@ -24540,9 +25213,11 @@ export interface operations {
                 "application/json": {
                     /** @description The email address to associate with the one-time token. */
                     email: string;
-                    /** @description Additional context to store with the one-time token. This can be used to store arbitrary data that will be associated with the token. */
+                    /** @description Additional context to store with the one-time token. Set `interactionEvent` to scope the token to a specific flow, such as `ForgotPassword` for reset-password magic links. */
                     context?: {
                         jitOrganizationIds?: string[];
+                        /** @enum {string} */
+                        interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                     };
                     /** @description The expiration time in seconds. If not provided, defaults to 10 mins (600 seconds). */
                     expiresIn?: number;
@@ -24563,6 +25238,8 @@ export interface operations {
                         token: string;
                         context: {
                             jitOrganizationIds?: string[];
+                            /** @enum {string} */
+                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                         };
                         /** @enum {string} */
                         status: "active" | "consumed" | "revoked" | "expired";
@@ -24619,6 +25296,8 @@ export interface operations {
                         token: string;
                         context: {
                             jitOrganizationIds?: string[];
+                            /** @enum {string} */
+                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                         };
                         /** @enum {string} */
                         status: "active" | "consumed" | "revoked" | "expired";
@@ -24737,6 +25416,8 @@ export interface operations {
                         token: string;
                         context: {
                             jitOrganizationIds?: string[];
+                            /** @enum {string} */
+                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                         };
                         /** @enum {string} */
                         status: "active" | "consumed" | "revoked" | "expired";
@@ -24810,6 +25491,8 @@ export interface operations {
                         token: string;
                         context: {
                             jitOrganizationIds?: string[];
+                            /** @enum {string} */
+                            interactionEvent?: "SignIn" | "Register" | "ForgotPassword";
                         };
                         /** @enum {string} */
                         status: "active" | "consumed" | "revoked" | "expired";
@@ -26303,11 +26986,6 @@ export interface operations {
                             maxAttempts?: number;
                             lockoutDuration?: number;
                         };
-                        emailBlocklistPolicy: {
-                            blockDisposableAddresses?: boolean;
-                            blockSubaddressing?: boolean;
-                            customBlocklist?: string[];
-                        };
                         verificationCodePolicy: {
                             expirationDuration?: number;
                             maxRetryAttempts?: number;
@@ -26650,11 +27328,6 @@ export interface operations {
                             maxAttempts?: number;
                             lockoutDuration?: number;
                         };
-                        emailBlocklistPolicy: {
-                            blockDisposableAddresses?: boolean;
-                            blockSubaddressing?: boolean;
-                            customBlocklist?: string[];
-                        };
                         verificationCodePolicy: {
                             expirationDuration?: number;
                             maxRetryAttempts?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/api",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "description": "Logto API types and clients.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",