@meshery/schemas 1.3.49 → 1.3.51

package/dist/constructs/v1beta1/organization_smtp/OrganizationSmtp.d.ts

@@ -0,0 +1,1220 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/api/identity/orgs/{orgId}/smtp-configuration": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an organization's SMTP configuration
+         * @description Returns the organization's mail server configuration, including its current health and from-domain verification state. The password is always the redaction sentinel `***`.
+         */
+        get: operations["getOrganizationSmtpConfiguration"];
+        /**
+         * Create or replace an organization's SMTP configuration
+         * @description Writes the organization's single mail server configuration, creating it if absent. The whole document is replaced, with one exception: a `password` of `***` or an empty string preserves the stored password, so a client may edit an unrelated field after a read without erasing the credential.
+         *     Changing the from address resets from-domain verification, and `enabled` is refused while the from domain is unverified.
+         */
+        put: operations["upsertOrganizationSmtpConfiguration"];
+        post?: never;
+        /**
+         * Remove an organization's SMTP configuration
+         * @description Removes the configuration and its stored credential. The organization's mail reverts to the provider's shared relay.
+         */
+        delete: operations["deleteOrganizationSmtpConfiguration"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/identity/orgs/{orgId}/smtp-configuration/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test message through an organization's SMTP configuration
+         * @description Delivers a real message through the configured server and reports a classified outcome. A real delivery rather than a connection probe on purpose: a server that connects and authenticates but refuses the sender or the recipient is the most common misconfiguration, and a probe reports it healthy.
+         *     The recipient defaults to the calling administrator's own address. The outcome is a classification, never the remote server's own text.
+         */
+        post: operations["testOrganizationSmtpConfiguration"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/identity/orgs/{orgId}/smtp-configuration/domain-verification": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the from-domain verification challenge
+         * @description Returns the DNS record the organization must publish to prove control of its from domain, together with the current verification state. A from domain that matches the organization's own registered custom domain is already proven and needs no record.
+         */
+        get: operations["getOrganizationSmtpDomainVerification"];
+        put?: never;
+        /**
+         * Check the from-domain verification challenge
+         * @description Resolves the challenge record and records the result. Proving the domain is what permits the configuration to be enabled.
+         */
+        post: operations["verifyOrganizationSmtpDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /**
+         * OrganizationSmtpConfiguration
+         * @description An organization's own outbound mail server. When present and enabled, every transactional email whose reader belongs to this organization - application notifications and identity-flow mail (account verification, password recovery) alike - is delivered through this server rather than through the provider's shared relay, so the message leaves from the organization's own domain. At most one live configuration exists per organization. The SMTP password is encrypted at rest and is never returned; reads always carry the redaction sentinel instead.
+         * @example {
+         *       "id": "00000000-0000-0000-0000-000000000000",
+         *       "organizationId": "00000000-0000-0000-0000-000000000000",
+         *       "host": "smtp.example.com",
+         *       "port": 587,
+         *       "encryption": "starttls",
+         *       "authMechanism": "plain",
+         *       "username": "no-reply@example.com",
+         *       "password": "***",
+         *       "fromAddress": "no-reply@example.com",
+         *       "fromDisplayName": "Example Corp",
+         *       "replyToAddress": "support@example.com",
+         *       "enabled": true,
+         *       "fallbackToProvider": true,
+         *       "fromDomain": "example.com",
+         *       "fromDomainVerificationToken": "0f6a5d2c9b1e4a7f8c3d6b0e2a4f7c19",
+         *       "fromDomainVerifiedAt": null,
+         *       "verificationState": "unverified",
+         *       "lastSuccessAt": null,
+         *       "lastFailureAt": null,
+         *       "lastFailureReason": null,
+         *       "consecutiveFailures": 0,
+         *       "createdBy": "00000000-0000-0000-0000-000000000000",
+         *       "createdAt": "0001-01-01T00:00:00Z",
+         *       "updatedAt": "0001-01-01T00:00:00Z",
+         *       "deletedAt": null
+         *     }
+         */
+        OrganizationSmtpConfiguration: {
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            organizationId: string;
+            /** @description Hostname of the organization's SMTP server. */
+            host: string;
+            /**
+             * @description TCP port the organization's SMTP server listens on.
+             * @default 587
+             */
+            port: number;
+            /**
+             * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+             * @default starttls
+             * @enum {string}
+             */
+            encryption: "starttls" | "tls" | "none";
+            /**
+             * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+             * @default plain
+             * @enum {string}
+             */
+            authMechanism: "plain" | "cram-md5" | "none";
+            /** @description Username presented to the organization's SMTP server. */
+            username?: string;
+            /** @description Password presented to the organization's SMTP server. Write-only. A read always returns the redaction sentinel `***`; the stored value is encrypted at rest and is never projected into a response. Writing `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+            password?: string;
+            /**
+             * Format: email
+             * @description Address the organization's mail is sent from. Its domain must be verified before the configuration can be enabled.
+             */
+            fromAddress: string;
+            /** @description Display name shown alongside the from address in the message header. */
+            fromDisplayName?: string;
+            /**
+             * Format: email
+             * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+             */
+            replyToAddress?: string;
+            /**
+             * @description Whether mail is routed through this server. Cannot be set while the from domain is unverified.
+             * @default false
+             */
+            enabled: boolean;
+            /**
+             * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+             * @default true
+             */
+            fallbackToProvider: boolean;
+            /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+            fromDomain?: string;
+            /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+            fromDomainVerificationToken?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+             */
+            fromDomainVerifiedAt?: string | null;
+            /**
+             * @description Health of the configuration. `unverified` means it has never delivered a test message, `verified` means the last delivery attempt succeeded, and `failing` means consecutive failures have opened the circuit and mail is being handled under the fallback setting without dialling this server.
+             * @default unverified
+             * @enum {string}
+             */
+            verificationState: "unverified" | "verified" | "failing";
+            /**
+             * Format: date-time
+             * @description Timestamp of the last message this server accepted.
+             */
+            lastSuccessAt?: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+             */
+            lastFailureAt?: string | null;
+            /**
+             * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+             * @enum {string}
+             */
+            lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+            /**
+             * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+             * @default 0
+             */
+            consecutiveFailures: number;
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            createdBy?: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was created.
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was last changed.
+             */
+            updatedAt: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+             */
+            deletedAt?: string | null;
+        };
+        /** @description Client-settable fields of an organization's mail server configuration. Health, verification state and timestamps are server-owned and are not accepted here. */
+        OrganizationSmtpConfigurationPayload: {
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            id?: string;
+            /** @description Hostname of the organization's SMTP server. */
+            host: string;
+            /**
+             * @description TCP port the organization's SMTP server listens on.
+             * @default 587
+             */
+            port: number;
+            /**
+             * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+             * @default starttls
+             * @enum {string}
+             */
+            encryption: "starttls" | "tls" | "none";
+            /**
+             * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+             * @default plain
+             * @enum {string}
+             */
+            authMechanism: "plain" | "cram-md5" | "none";
+            /** @description Username presented to the organization's SMTP server. */
+            username?: string;
+            /** @description Password presented to the organization's SMTP server. Write-only. `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+            password?: string;
+            /**
+             * Format: email
+             * @description Address the organization's mail is sent from. Changing it resets from-domain verification.
+             */
+            fromAddress: string;
+            /** @description Display name shown alongside the from address. */
+            fromDisplayName?: string;
+            /**
+             * Format: email
+             * @description Address replies are directed to.
+             */
+            replyToAddress?: string;
+            /**
+             * @description Whether mail is routed through this server. Refused while the from domain is unverified.
+             * @default false
+             */
+            enabled: boolean;
+            /**
+             * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+             * @default true
+             */
+            fallbackToProvider: boolean;
+        };
+        /** @description Options for a test delivery. */
+        OrganizationSmtpTestRequest: {
+            /**
+             * Format: email
+             * @description Recipient of the test message. Defaults to the calling administrator's own address.
+             */
+            to?: string;
+        };
+        /** @description Classified outcome of a test delivery. Carries no text from the remote server, so a refusal reveals nothing about what the network can reach. */
+        OrganizationSmtpTestResult: {
+            /**
+             * @description What happened. `delivered` means the server accepted the message; every other value names the stage that refused it.
+             * @enum {string}
+             */
+            outcome: "delivered" | "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+            /** @description Human-readable summary of the outcome, drawn from a fixed set of phrasings. */
+            message?: string;
+            /**
+             * Format: email
+             * @description Address the test message was addressed to.
+             */
+            sentTo?: string;
+            /**
+             * Format: date-time
+             * @description When the delivery was attempted.
+             */
+            testedAt: string;
+        };
+        /** @description The DNS record proving control of an organization's from domain, and the current state of that proof. */
+        OrganizationSmtpDomainChallenge: {
+            /** @description Registrable domain the proof applies to. */
+            domain: string;
+            /**
+             * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+             * @enum {string}
+             */
+            method: "custom-domain" | "dns-txt";
+            /** @description Fully qualified name of the TXT record to publish. */
+            recordName?: string;
+            /** @description Value the TXT record must carry. */
+            recordValue?: string;
+            /** @description Whether control of the domain is currently proven. */
+            verified: boolean;
+            /**
+             * Format: date-time
+             * @description When control was last proven. Null while unproven.
+             */
+            verifiedAt?: string | null;
+            /**
+             * @description Why the last check did not prove control.
+             * @enum {string}
+             */
+            failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+        };
+    };
+    responses: {
+        /** @description Invalid request body or request param */
+        400: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Expired JWT token used or insufficient privilege */
+        401: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Caller lacks the permission key required for this organization */
+        403: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Result not found */
+        404: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Too many attempts for this organization */
+        429: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Internal server error */
+        500: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+    };
+    parameters: {
+        /** @description Organization ID */
+        orgId: string;
+    };
+    requestBodies: {
+        organizationSmtpConfigurationPayload: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: uuid
+                     * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                     */
+                    id?: string;
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. */
+                    username?: string;
+                    /** @description Password presented to the organization's SMTP server. Write-only. `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+                    password?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from. Changing it resets from-domain verification.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether mail is routed through this server. Refused while the from domain is unverified.
+                     * @default false
+                     */
+                    enabled?: boolean;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        organizationSmtpTestRequest: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: email
+                     * @description Recipient of the test message. Defaults to the calling administrator's own address.
+                     */
+                    to?: string;
+                };
+            };
+        };
+    };
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    getOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The organization's SMTP configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. */
+                        username?: string;
+                        /** @description Password presented to the organization's SMTP server. Write-only. A read always returns the redaction sentinel `***`; the stored value is encrypted at rest and is never projected into a response. Writing `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+                        password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before the configuration can be enabled.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Whether mail is routed through this server. Cannot be set while the from domain is unverified.
+                         * @default false
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * @description Health of the configuration. `unverified` means it has never delivered a test message, `verified` means the last delivery attempt succeeded, and `failing` means consecutive failures have opened the circuit and mail is being handled under the fallback setting without dialling this server.
+                         * @default unverified
+                         * @enum {string}
+                         */
+                        verificationState: "unverified" | "verified" | "failing";
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    upsertOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: uuid
+                     * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                     */
+                    id?: string;
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. */
+                    username?: string;
+                    /** @description Password presented to the organization's SMTP server. Write-only. `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+                    password?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from. Changing it resets from-domain verification.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether mail is routed through this server. Refused while the from domain is unverified.
+                     * @default false
+                     */
+                    enabled?: boolean;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The stored SMTP configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. */
+                        username?: string;
+                        /** @description Password presented to the organization's SMTP server. Write-only. A read always returns the redaction sentinel `***`; the stored value is encrypted at rest and is never projected into a response. Writing `***` or an empty string preserves the stored password, so a client may round-trip a read without erasing the credential. */
+                        password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before the configuration can be enabled.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Whether mail is routed through this server. Cannot be set while the from domain is unverified.
+                         * @default false
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * @description Health of the configuration. `unverified` means it has never delivered a test message, `verified` means the last delivery attempt succeeded, and `failing` means consecutive failures have opened the circuit and mail is being handled under the fallback setting without dialling this server.
+                         * @default unverified
+                         * @enum {string}
+                         */
+                        verificationState: "unverified" | "verified" | "failing";
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    deleteOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The configuration was removed. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    testOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: email
+                     * @description Recipient of the test message. Defaults to the calling administrator's own address.
+                     */
+                    to?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The classified outcome of the delivery attempt. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description What happened. `delivered` means the server accepted the message; every other value names the stage that refused it.
+                         * @enum {string}
+                         */
+                        outcome: "delivered" | "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /** @description Human-readable summary of the outcome, drawn from a fixed set of phrasings. */
+                        message?: string;
+                        /**
+                         * Format: email
+                         * @description Address the test message was addressed to.
+                         */
+                        sentTo?: string;
+                        /**
+                         * Format: date-time
+                         * @description When the delivery was attempted.
+                         */
+                        testedAt: string;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Too many attempts for this organization */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    getOrganizationSmtpDomainVerification: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The verification challenge and its current state. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Registrable domain the proof applies to. */
+                        domain: string;
+                        /**
+                         * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+                         * @enum {string}
+                         */
+                        method: "custom-domain" | "dns-txt";
+                        /** @description Fully qualified name of the TXT record to publish. */
+                        recordName?: string;
+                        /** @description Value the TXT record must carry. */
+                        recordValue?: string;
+                        /** @description Whether control of the domain is currently proven. */
+                        verified: boolean;
+                        /**
+                         * Format: date-time
+                         * @description When control was last proven. Null while unproven.
+                         */
+                        verifiedAt?: string | null;
+                        /**
+                         * @description Why the last check did not prove control.
+                         * @enum {string}
+                         */
+                        failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+                    };
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    verifyOrganizationSmtpDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The outcome of the verification check. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Registrable domain the proof applies to. */
+                        domain: string;
+                        /**
+                         * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+                         * @enum {string}
+                         */
+                        method: "custom-domain" | "dns-txt";
+                        /** @description Fully qualified name of the TXT record to publish. */
+                        recordName?: string;
+                        /** @description Value the TXT record must carry. */
+                        recordValue?: string;
+                        /** @description Whether control of the domain is currently proven. */
+                        verified: boolean;
+                        /**
+                         * Format: date-time
+                         * @description When control was last proven. Null while unproven.
+                         */
+                        verifiedAt?: string | null;
+                        /**
+                         * @description Why the last check did not prove control.
+                         * @enum {string}
+                         */
+                        failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Too many attempts for this organization */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+}