@meshery/schemas 1.3.50 → 1.3.52

package/dist/constructs/v1beta1/organization_smtp/OrganizationSmtp.d.ts

@@ -0,0 +1,2102 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/api/orgs/{orgId}/environments/mail-relay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Probe whether an organization has brought its own mail server
+         * @description Returns the organization's mail-relay environment when it exists. A 404 is the ordinary answer for an organization using the provider's shared relay, and is not an error condition.
+         */
+        get: operations["getOrganizationSmtpEnvironment"];
+        put?: never;
+        post?: never;
+        /**
+         * Remove an organization's mail server entirely
+         * @description Removes the configuration, its stored credential and the environment that held them, together. The organization's mail reverts to the provider's shared relay.
+         *     Idempotent, and deliberately declares no 404: removing an absent configuration succeeds with the same 204 as removing a present one, so "not found" is not an outcome this operation has. An unknown or unauthorized organization is answered by the permission middleware before the handler runs.
+         */
+        delete: operations["deleteOrganizationSmtpEnvironment"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/orgs/{orgId}/environments/mail-relay/connection": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an organization's SMTP configuration
+         * @description Returns the organization's mail server configuration, including its current status and from-domain verification state. The password is always the redaction sentinel `***`.
+         */
+        get: operations["getOrganizationSmtpConfiguration"];
+        /**
+         * Update an organization's SMTP settings
+         * @description Replaces the settings. The payload has no `password` property at all and rejects unknown properties, so this operation cannot carry a credential even by accident - rotating the password is a separate operation. That is what lets an administrator rename a display name without retyping a secret, while the redaction sentinel stays refused everywhere it can be written.
+         *     Changing the from address to a different registrable domain resets from-domain verification and returns the configuration to `registered`.
+         */
+        put: operations["updateOrganizationSmtpConfiguration"];
+        /**
+         * Register an organization's SMTP server
+         * @description Creates the configuration, provisioning the mail-relay environment on the organization's behalf when it does not yet exist. This is the only operation that accepts the password alongside the settings; afterwards the two are written separately.
+         *     The new configuration starts unproven, so mail continues to take the provider relay until the from domain is verified and a test delivery succeeds.
+         *     Declares no 404 for the same reason the delete does not: this operation brings the configuration into existence, so its absence beforehand is the normal case rather than an error.
+         */
+        post: operations["createOrganizationSmtpConfiguration"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/orgs/{orgId}/environments/mail-relay/connection/credential": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Rotate the password presented to an organization's SMTP server
+         * @description Replaces the stored password. The redaction sentinel `***` and the empty string are REFUSED with a 400 rather than treated as "leave it alone", so a client that echoes a read back cannot overwrite the credential with the sentinel.
+         */
+        put: operations["rotateOrganizationSmtpCredential"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/orgs/{orgId}/environments/mail-relay/connection/enablement": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Turn an organization's own mail server on or off
+         * @description The only operation by which an administrator writes the configuration's status, and it can write only the two administrative states: turning it off moves the configuration to `ignored`, and turning it on returns it to `registered` so that it must prove itself again before mail is routed. `connected` and `disconnected` are written by delivery outcomes alone and are never settable here, which is what keeps a deliberate opt-out distinguishable from a failing relay.
+         *     Turning it on is refused with a 409 while the from domain is unverified.
+         */
+        post: operations["setOrganizationSmtpEnablement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/orgs/{orgId}/environments/mail-relay/connection/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test message through an organization's SMTP configuration
+         * @description Delivers a real message through the configured server and reports a classified outcome. A real delivery rather than a connection probe on purpose: a server that connects and authenticates but refuses the sender or the recipient is the most common misconfiguration, and a probe reports it healthy.
+         *     A successful test is also what promotes a verified configuration from `registered` to `connected`, so this operation is part of the lifecycle rather than a convenience. It takes the same permission as a write, because there is no read-only form of dialling an arbitrary host, and it is rate limited per organization.
+         *     The recipient defaults to the calling administrator's own address. The outcome is a classification, never the remote server's own text.
+         */
+        post: operations["testOrganizationSmtpConfiguration"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/orgs/{orgId}/environments/mail-relay/domain-verification": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the from-domain verification challenge
+         * @description Returns the DNS record the organization must publish to prove control of its from domain, together with the current verification state. A from domain that matches the organization's own registered custom domain is already proven and needs no record.
+         */
+        get: operations["getOrganizationSmtpDomainVerification"];
+        put?: never;
+        /**
+         * Check the from-domain verification challenge
+         * @description Resolves the challenge record and records the result. Proving the domain is what permits mail to be routed through the organization's server. Rate limited per organization.
+         */
+        post: operations["verifyOrganizationSmtpDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /**
+         * OrganizationSmtpConfiguration
+         * @description An organization's own outbound mail server. When present and healthy, every transactional email whose reader belongs to this organization - application notifications and identity-flow mail (account verification, password recovery) alike - is delivered through this server rather than through the provider's shared relay, so the message leaves from the organization's own domain. At most one live configuration exists per organization. The SMTP password is encrypted at rest and is never returned; reads always carry the redaction sentinel instead.
+         *
+         *     This is a WIRE contract only. It is not backed by a table of its own: the configuration is stored on the same environment/connection/credential chain that bring-your-own identity providers already uses - a well-known per-organization Environment, joined through environments_connections_mappings to a Connection whose credential_id points at a Credential. The organization relationship lives on `environments.organization_id`, the dial target on `connections.url` and `connections.metadata`, the transport verdict on `connections.status`, and the password alone in `credentials.secret`.
+         *
+         *     No property here carries a construct-specific `db` tag, because no property here names a column of its own. The exception is deliberate and inherited: `createdAt` and `updatedAt` `$ref` the shared core definitions, which declare `db: created_at` / `db: updated_at` for every construct that uses them, and those two tags are accurate for the underlying connection row.
+         * @example {
+         *       "id": "00000000-0000-0000-0000-000000000000",
+         *       "organizationId": "00000000-0000-0000-0000-000000000000",
+         *       "host": "smtp.example.com",
+         *       "port": 587,
+         *       "encryption": "starttls",
+         *       "authMechanism": "plain",
+         *       "username": "no-reply@example.com",
+         *       "password": "***",
+         *       "fromAddress": "no-reply@example.com",
+         *       "fromDisplayName": "Example Corp",
+         *       "replyToAddress": "support@example.com",
+         *       "status": "registered",
+         *       "fallbackToProvider": true,
+         *       "fromDomain": "example.com",
+         *       "fromDomainVerificationToken": "0f6a5d2c9b1e4a7f8c3d6b0e2a4f7c19",
+         *       "fromDomainVerifiedAt": null,
+         *       "lastSuccessAt": null,
+         *       "lastFailureAt": null,
+         *       "consecutiveFailures": 0,
+         *       "createdBy": "00000000-0000-0000-0000-000000000000",
+         *       "createdAt": "0001-01-01T00:00:00Z",
+         *       "updatedAt": "0001-01-01T00:00:00Z",
+         *       "deletedAt": null
+         *     }
+         */
+        OrganizationSmtpConfiguration: {
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            organizationId: string;
+            /** @description Hostname of the organization's SMTP server. */
+            host: string;
+            /**
+             * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+             * @default 587
+             */
+            port: number;
+            /**
+             * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+             * @default starttls
+             * @enum {string}
+             */
+            encryption: "starttls" | "tls" | "none";
+            /**
+             * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+             * @default plain
+             * @enum {string}
+             */
+            authMechanism: "plain" | "cram-md5" | "none";
+            /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+            username?: string;
+            /**
+             * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+             *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+             */
+            readonly password?: string;
+            /**
+             * Format: email
+             * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+             */
+            fromAddress: string;
+            /** @description Display name shown alongside the from address in the message header. */
+            fromDisplayName?: string;
+            /**
+             * Format: email
+             * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+             */
+            replyToAddress?: string;
+            /**
+             * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+             *
+             *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+             * @default registered
+             * @enum {string}
+             */
+            status: "registered" | "connected" | "disconnected" | "ignored";
+            /**
+             * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+             * @default true
+             */
+            fallbackToProvider: boolean;
+            /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+            fromDomain?: string;
+            /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+            fromDomainVerificationToken?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+             */
+            fromDomainVerifiedAt?: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp of the last message this server accepted.
+             */
+            lastSuccessAt?: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+             */
+            lastFailureAt?: string | null;
+            /**
+             * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+             * @enum {string}
+             */
+            lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+            /**
+             * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+             * @default 0
+             */
+            consecutiveFailures: number;
+            /**
+             * Format: uuid
+             * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+             */
+            createdBy?: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was created.
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was last changed.
+             */
+            updatedAt: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+             */
+            deletedAt?: string | null;
+        };
+        /**
+         * @description Everything needed to register an organization's mail server, settings and password together, so that registration is one operation. Accepted only on create; afterwards the settings and the credential are written by separate operations.
+         *     `status`, the delivery counters behind it, the from-domain proof and the timestamps are all server-owned and are not accepted here. A new configuration therefore always starts at `registered`, whatever the caller sends.
+         */
+        OrganizationSmtpConfigurationPayload: {
+            /** @description Hostname of the organization's SMTP server. */
+            host: string;
+            /**
+             * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+             * @default 587
+             */
+            port: number;
+            /**
+             * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+             * @default starttls
+             * @enum {string}
+             */
+            encryption: "starttls" | "tls" | "none";
+            /**
+             * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+             * @default plain
+             * @enum {string}
+             */
+            authMechanism: "plain" | "cram-md5" | "none";
+            /** @description Username presented to the organization's SMTP server. Required by the server, together with `password`, for every `authMechanism` other than `none`; see that property for why the pairing is a server-enforced contract rather than a schema constraint. */
+            username?: string;
+            /**
+             * @description Password presented to the organization's SMTP server. The server requires it, together with `username`, for every `authMechanism` other than `none`, and answers 400 when either is missing.
+             *     That rule is deliberately NOT encoded in `required` or as a `oneOf`/`if`-`then`. Both encodings were measured against the generator: `if`/`then` collapses this payload to `interface{}`, and `oneOf` injects a `union json.RawMessage` field with a custom marshaller, either of which costs every consumer its generated type or its wire behaviour to express a constraint the server enforces anyway. Treat this property as conditionally required by contract, not by schema.
+             *     This is the ONLY operation that accepts the password alongside the settings, so that registering a mail server is one call and no configuration exists in a state where it is expected to send but holds no credential. Afterwards the password is written only by the rotation operation, never by the settings update, whose payload declares no `password` property at all.
+             *     The redaction sentinel `***` is refused, and so is the empty string - omit the property instead of sending it empty, which the `minLength` below enforces so this payload and the rotation payload agree.
+             */
+            password?: string;
+            /**
+             * Format: email
+             * @description Address the organization's mail is sent from.
+             */
+            fromAddress: string;
+            /** @description Display name shown alongside the from address. */
+            fromDisplayName?: string;
+            /**
+             * Format: email
+             * @description Address replies are directed to.
+             */
+            replyToAddress?: string;
+            /**
+             * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+             * @default true
+             */
+            fallbackToProvider: boolean;
+        };
+        /** @description Client-settable settings of an organization's mail server, WITHOUT the password. The omission is deliberate and structural: because this schema forbids unknown properties, a client cannot send a credential through this operation at all, so the read-then-write round trip that would otherwise overwrite a stored password with the redaction sentinel is not expressible. Rotate the password through its own operation. */
+        OrganizationSmtpSettingsPayload: {
+            /** @description Hostname of the organization's SMTP server. */
+            host: string;
+            /**
+             * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+             * @default 587
+             */
+            port: number;
+            /**
+             * @description Transport encryption to negotiate.
+             * @default starttls
+             * @enum {string}
+             */
+            encryption: "starttls" | "tls" | "none";
+            /**
+             * @description SMTP authentication mechanism. Changing this to a mechanism other than `none` while no password is stored is refused; rotate the credential first.
+             * @default plain
+             * @enum {string}
+             */
+            authMechanism: "plain" | "cram-md5" | "none";
+            /** @description Username presented to the organization's SMTP server. */
+            username?: string;
+            /**
+             * Format: email
+             * @description Address the organization's mail is sent from. Changing it to a different registrable domain resets from-domain verification.
+             */
+            fromAddress: string;
+            /** @description Display name shown alongside the from address. */
+            fromDisplayName?: string;
+            /**
+             * Format: email
+             * @description Address replies are directed to.
+             */
+            replyToAddress?: string;
+            /**
+             * @description Whether a message this server fails to accept is re-sent through the provider's shared relay.
+             * @default true
+             */
+            fallbackToProvider: boolean;
+        };
+        /** @description The password presented to an organization's SMTP server. The only payload that carries it after creation. */
+        OrganizationSmtpCredentialPayload: {
+            /** @description New password. The redaction sentinel `***` and the empty string are refused with a 400 rather than treated as "leave the stored value alone", so echoing a read back cannot erase the credential. */
+            password: string;
+        };
+        /** @description Administrative on/off for an organization's own mail server. It cannot express the delivery-driven states, which are written by outcomes alone. */
+        OrganizationSmtpEnablementPayload: {
+            /** @description True returns the configuration to `registered` so it may prove itself and carry mail; false moves it to `ignored`. Turning it on is refused while the from domain is unverified. */
+            enabled: boolean;
+        };
+        /** @description Options for a test delivery. */
+        OrganizationSmtpTestRequest: {
+            /**
+             * Format: email
+             * @description Recipient of the test message. Defaults to the calling administrator's own address.
+             */
+            to?: string;
+        };
+        /** @description Classified outcome of a test delivery. Carries no text from the remote server, so a refusal reveals nothing about what the network can reach. */
+        OrganizationSmtpTestResult: {
+            /**
+             * @description What happened. `delivered` means the server accepted the message; every other value names the stage that refused it.
+             * @enum {string}
+             */
+            outcome: "delivered" | "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+            /** @description Human-readable summary of the outcome, drawn from a fixed set of phrasings. */
+            message?: string;
+            /**
+             * Format: email
+             * @description Address the test message was addressed to.
+             */
+            sentTo?: string;
+            /**
+             * Format: date-time
+             * @description When the delivery was attempted.
+             */
+            testedAt: string;
+        };
+        /** @description The DNS record proving control of an organization's from domain, and the current state of that proof. */
+        OrganizationSmtpDomainChallenge: {
+            /** @description Registrable domain the proof applies to. */
+            domain: string;
+            /**
+             * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+             * @enum {string}
+             */
+            method: "custom-domain" | "dns-txt";
+            /** @description Fully qualified name of the TXT record to publish. */
+            recordName?: string;
+            /** @description Value the TXT record must carry. */
+            recordValue?: string;
+            /** @description Whether control of the domain is currently proven. */
+            verified: boolean;
+            /**
+             * Format: date-time
+             * @description When control was last proven. Null while unproven.
+             */
+            verifiedAt?: string | null;
+            /**
+             * @description Why the last check did not prove control.
+             * @enum {string}
+             */
+            failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+        };
+    };
+    responses: {
+        /** @description Invalid request body or request param */
+        400: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Expired JWT token used or insufficient privilege */
+        401: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Caller lacks the permission key required for this organization */
+        403: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Result not found */
+        404: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description The configuration already exists, or the requested state transition is refused in the configuration's current state */
+        409: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Too many attempts for this organization */
+        429: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+        /** @description Internal server error */
+        500: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/plain": string;
+            };
+        };
+    };
+    parameters: {
+        /** @description Organization ID */
+        orgId: string;
+    };
+    requestBodies: {
+        organizationSmtpConfigurationPayload: {
+            content: {
+                "application/json": {
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. Required by the server, together with `password`, for every `authMechanism` other than `none`; see that property for why the pairing is a server-enforced contract rather than a schema constraint. */
+                    username?: string;
+                    /**
+                     * @description Password presented to the organization's SMTP server. The server requires it, together with `username`, for every `authMechanism` other than `none`, and answers 400 when either is missing.
+                     *     That rule is deliberately NOT encoded in `required` or as a `oneOf`/`if`-`then`. Both encodings were measured against the generator: `if`/`then` collapses this payload to `interface{}`, and `oneOf` injects a `union json.RawMessage` field with a custom marshaller, either of which costs every consumer its generated type or its wire behaviour to express a constraint the server enforces anyway. Treat this property as conditionally required by contract, not by schema.
+                     *     This is the ONLY operation that accepts the password alongside the settings, so that registering a mail server is one call and no configuration exists in a state where it is expected to send but holds no credential. Afterwards the password is written only by the rotation operation, never by the settings update, whose payload declares no `password` property at all.
+                     *     The redaction sentinel `***` is refused, and so is the empty string - omit the property instead of sending it empty, which the `minLength` below enforces so this payload and the rotation payload agree.
+                     */
+                    password?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        organizationSmtpSettingsPayload: {
+            content: {
+                "application/json": {
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Changing this to a mechanism other than `none` while no password is stored is refused; rotate the credential first.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. */
+                    username?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from. Changing it to a different registrable domain resets from-domain verification.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        organizationSmtpCredentialPayload: {
+            content: {
+                "application/json": {
+                    /** @description New password. The redaction sentinel `***` and the empty string are refused with a 400 rather than treated as "leave the stored value alone", so echoing a read back cannot erase the credential. */
+                    password: string;
+                };
+            };
+        };
+        organizationSmtpEnablementPayload: {
+            content: {
+                "application/json": {
+                    /** @description True returns the configuration to `registered` so it may prove itself and carry mail; false moves it to `ignored`. Turning it on is refused while the from domain is unverified. */
+                    enabled: boolean;
+                };
+            };
+        };
+        organizationSmtpTestRequest: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: email
+                     * @description Recipient of the test message. Defaults to the calling administrator's own address.
+                     */
+                    to?: string;
+                };
+            };
+        };
+    };
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    getOrganizationSmtpEnvironment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The organization has its own mail-relay environment. The canonical Environment shape, not a bespoke one: this endpoint returns an ordinary environment row that happens to carry the well-known name. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description ID
+                         */
+                        id: string;
+                        /**
+                         * @description Specifies the version of the schema to which the environment conforms.
+                         * @default environments.meshery.io/v1beta3
+                         * @example [
+                         *       "v1",
+                         *       "v1alpha1",
+                         *       "v2beta3",
+                         *       "v1.custom-suffix",
+                         *       "models.meshery.io/v1beta1",
+                         *       "capability.meshery.io/v1alpha1"
+                         *     ]
+                         */
+                        schemaVersion: string;
+                        /** @description Environment name */
+                        name: string;
+                        /** @description Environment description */
+                        description: string;
+                        /**
+                         * Format: uuid
+                         * @description Environment organization ID
+                         */
+                        organizationId: string;
+                        /**
+                         * Format: uuid
+                         * @description Environment owner
+                         */
+                        owner?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the environment was created.
+                         */
+                        createdAt?: string;
+                        /** @description Additional metadata associated with the environment. */
+                        metadata?: Record<string, never>;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the environment was last updated.
+                         */
+                        updatedAt?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the environment was soft deleted. Null while the environment remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    deleteOrganizationSmtpEnvironment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The configuration was removed. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    getOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The organization's SMTP configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+                        username?: string;
+                        /**
+                         * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+                         *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+                         */
+                        readonly password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+                         *
+                         *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+                         * @default registered
+                         * @enum {string}
+                         */
+                        status: "registered" | "connected" | "disconnected" | "ignored";
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    updateOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Changing this to a mechanism other than `none` while no password is stored is refused; rotate the credential first.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. */
+                    username?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from. Changing it to a different registrable domain resets from-domain verification.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The stored SMTP configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+                        username?: string;
+                        /**
+                         * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+                         *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+                         */
+                        readonly password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+                         *
+                         *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+                         * @default registered
+                         * @enum {string}
+                         */
+                        status: "registered" | "connected" | "disconnected" | "ignored";
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    createOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Hostname of the organization's SMTP server. */
+                    host: string;
+                    /**
+                     * @description TCP port the organization's SMTP server listens on. Restricted further by a submission-port allowlist.
+                     * @default 587
+                     */
+                    port: number;
+                    /**
+                     * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext.
+                     * @default starttls
+                     * @enum {string}
+                     */
+                    encryption?: "starttls" | "tls" | "none";
+                    /**
+                     * @description SMTP authentication mechanism. Any mechanism other than `none` requires both a username and a password.
+                     * @default plain
+                     * @enum {string}
+                     */
+                    authMechanism?: "plain" | "cram-md5" | "none";
+                    /** @description Username presented to the organization's SMTP server. Required by the server, together with `password`, for every `authMechanism` other than `none`; see that property for why the pairing is a server-enforced contract rather than a schema constraint. */
+                    username?: string;
+                    /**
+                     * @description Password presented to the organization's SMTP server. The server requires it, together with `username`, for every `authMechanism` other than `none`, and answers 400 when either is missing.
+                     *     That rule is deliberately NOT encoded in `required` or as a `oneOf`/`if`-`then`. Both encodings were measured against the generator: `if`/`then` collapses this payload to `interface{}`, and `oneOf` injects a `union json.RawMessage` field with a custom marshaller, either of which costs every consumer its generated type or its wire behaviour to express a constraint the server enforces anyway. Treat this property as conditionally required by contract, not by schema.
+                     *     This is the ONLY operation that accepts the password alongside the settings, so that registering a mail server is one call and no configuration exists in a state where it is expected to send but holds no credential. Afterwards the password is written only by the rotation operation, never by the settings update, whose payload declares no `password` property at all.
+                     *     The redaction sentinel `***` is refused, and so is the empty string - omit the property instead of sending it empty, which the `minLength` below enforces so this payload and the rotation payload agree.
+                     */
+                    password?: string;
+                    /**
+                     * Format: email
+                     * @description Address the organization's mail is sent from.
+                     */
+                    fromAddress: string;
+                    /** @description Display name shown alongside the from address. */
+                    fromDisplayName?: string;
+                    /**
+                     * Format: email
+                     * @description Address replies are directed to.
+                     */
+                    replyToAddress?: string;
+                    /**
+                     * @description Whether a message this server fails to accept is re-sent through the provider's shared relay. Disabling it means a failure is a dropped message, account verification and password recovery included.
+                     * @default true
+                     */
+                    fallbackToProvider?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The stored SMTP configuration. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+                        username?: string;
+                        /**
+                         * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+                         *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+                         */
+                        readonly password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+                         *
+                         *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+                         * @default registered
+                         * @enum {string}
+                         */
+                        status: "registered" | "connected" | "disconnected" | "ignored";
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description The configuration already exists, or the requested state transition is refused in the configuration's current state */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    rotateOrganizationSmtpCredential: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New password. The redaction sentinel `***` and the empty string are refused with a 400 rather than treated as "leave the stored value alone", so echoing a read back cannot erase the credential. */
+                    password: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The stored SMTP configuration, with the password redacted. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+                        username?: string;
+                        /**
+                         * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+                         *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+                         */
+                        readonly password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+                         *
+                         *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+                         * @default registered
+                         * @enum {string}
+                         */
+                        status: "registered" | "connected" | "disconnected" | "ignored";
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    setOrganizationSmtpEnablement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description True returns the configuration to `registered` so it may prove itself and carry mail; false moves it to `ignored`. Turning it on is refused while the from domain is unverified. */
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The stored SMTP configuration. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        organizationId: string;
+                        /** @description Hostname of the organization's SMTP server. */
+                        host: string;
+                        /**
+                         * @description TCP port the organization's SMTP server listens on. The server additionally restricts this to a submission-port allowlist; a syntactically valid port outside it is refused.
+                         * @default 587
+                         */
+                        port: number;
+                        /**
+                         * @description Transport encryption to negotiate. `starttls` upgrades a cleartext connection (typically port 587), `tls` opens an implicit TLS connection (typically port 465), and `none` sends in cleartext and is intended only for an internal relay on a trusted network.
+                         * @default starttls
+                         * @enum {string}
+                         */
+                        encryption: "starttls" | "tls" | "none";
+                        /**
+                         * @description SMTP authentication mechanism. `none` is permitted only for a relay that authorizes by source address; a configuration using any other mechanism must carry both a username and a password.
+                         * @default plain
+                         * @enum {string}
+                         */
+                        authMechanism: "plain" | "cram-md5" | "none";
+                        /** @description Username presented to the organization's SMTP server. Held beside the host rather than with the password because it is an identifier rather than a secret, and the health surface must show it without a decryption round trip. It is usually an email address, so it is returned only on an authorized read. */
+                        username?: string;
+                        /**
+                         * @description Present only when a password is stored, and then always the redaction sentinel `***` - never the stored value, which is encrypted at rest and is never projected into a response. Its presence is therefore the only thing it reports: a configuration whose `authMechanism` is `none` stores no password and omits this property entirely. It is optional rather than required for exactly that reason.
+                         *     Read-only, and read-only here means read-only: no request body references this schema. The write semantics belong to the payload schemas - `OrganizationSmtpConfigurationPayload` on create and `OrganizationSmtpCredentialPayload` on rotation - and are documented there.
+                         */
+                        readonly password?: string;
+                        /**
+                         * Format: email
+                         * @description Address the organization's mail is sent from. Its domain must be verified before mail is routed through this server.
+                         */
+                        fromAddress: string;
+                        /** @description Display name shown alongside the from address in the message header. */
+                        fromDisplayName?: string;
+                        /**
+                         * Format: email
+                         * @description Address replies are directed to. It is also the address carried when a message falls back to the provider relay, which rewrites the from address to the provider's own so the message stays aligned for SPF and DMARC.
+                         */
+                        replyToAddress?: string;
+                        /**
+                         * @description Lifecycle and transport verdict, carrying the connection status vocabulary because the configuration IS a connection. `registered` means configured but never proven - the from domain is unverified, or no message has yet been delivered - and mail takes the provider relay. `connected` means the last delivery attempt succeeded and mail is routed through this server. `disconnected` means consecutive failures opened the circuit, so the server is no longer dialled and the fallback setting decides what happens. `ignored` means an administrator turned it off.
+                         *
+                         *     The writers are disjoint on purpose: only an administrator writes `ignored`, and only the delivery circuit writes `connected` or `disconnected`. That is what keeps a deliberate opt-out distinguishable from a failing relay. It also makes "enabled while the from domain is unverified" unrepresentable rather than merely forbidden, which is why this property replaces the separate `enabled` and `verificationState` pair it supersedes.
+                         * @default registered
+                         * @enum {string}
+                         */
+                        status: "registered" | "connected" | "disconnected" | "ignored";
+                        /**
+                         * @description Whether a message that this server fails to accept is re-sent through the provider's shared relay. Disabling it means the organization owns delivery entirely and a failure is a dropped message, including account verification and password recovery.
+                         * @default true
+                         */
+                        fallbackToProvider: boolean;
+                        /** @description Registrable domain of the from address, held separately as the unit that ownership is proven for. */
+                        fromDomain?: string;
+                        /** @description Token the organization publishes in DNS to prove control of the from domain. Not a credential - it authorizes nothing and grants no access. */
+                        fromDomainVerificationToken?: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp at which control of the from domain was last proven. Null while unproven.
+                         */
+                        fromDomainVerifiedAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last message this server accepted.
+                         */
+                        lastSuccessAt?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp of the last delivery attempt this server rejected or failed to accept.
+                         */
+                        lastFailureAt?: string | null;
+                        /**
+                         * @description Classification of the last failure. Always a classification, never the remote server's own message: the set is closed on purpose, because reporting a remote server's text back to a caller would turn a refusal into an oracle for what the network can reach.
+                         * @enum {string}
+                         */
+                        lastFailureReason?: "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /**
+                         * @description Delivery failures since the last success. Drives the circuit that stops dialling a persistently unreachable server.
+                         * @default 0
+                         */
+                        consecutiveFailures: number;
+                        /**
+                         * Format: uuid
+                         * @description A Universally Unique Identifier used to uniquely identify entities in Meshery. The UUID core definition is used across different schemas.
+                         */
+                        createdBy?: string | null;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was created.
+                         */
+                        createdAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was last changed.
+                         */
+                        updatedAt: string;
+                        /**
+                         * Format: date-time
+                         * @description Timestamp when the configuration was soft deleted. Null while it remains active.
+                         */
+                        deletedAt?: string | null;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description The configuration already exists, or the requested state transition is refused in the configuration's current state */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    testOrganizationSmtpConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: email
+                     * @description Recipient of the test message. Defaults to the calling administrator's own address.
+                     */
+                    to?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The classified outcome of the delivery attempt. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description What happened. `delivered` means the server accepted the message; every other value names the stage that refused it.
+                         * @enum {string}
+                         */
+                        outcome: "delivered" | "blocked_target" | "connect_refused" | "connect_timeout" | "tls_failed" | "starttls_unsupported" | "auth_rejected" | "relay_rejected_sender" | "relay_rejected_recipient" | "delivery_failed" | "credential_unreadable";
+                        /** @description Human-readable summary of the outcome, drawn from a fixed set of phrasings. */
+                        message?: string;
+                        /**
+                         * Format: email
+                         * @description Address the test message was addressed to.
+                         */
+                        sentTo?: string;
+                        /**
+                         * Format: date-time
+                         * @description When the delivery was attempted.
+                         */
+                        testedAt: string;
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Too many attempts for this organization */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    getOrganizationSmtpDomainVerification: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The verification challenge and its current state. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Registrable domain the proof applies to. */
+                        domain: string;
+                        /**
+                         * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+                         * @enum {string}
+                         */
+                        method: "custom-domain" | "dns-txt";
+                        /** @description Fully qualified name of the TXT record to publish. */
+                        recordName?: string;
+                        /** @description Value the TXT record must carry. */
+                        recordValue?: string;
+                        /** @description Whether control of the domain is currently proven. */
+                        verified: boolean;
+                        /**
+                         * Format: date-time
+                         * @description When control was last proven. Null while unproven.
+                         */
+                        verifiedAt?: string | null;
+                        /**
+                         * @description Why the last check did not prove control.
+                         * @enum {string}
+                         */
+                        failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+                    };
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+    verifyOrganizationSmtpDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Organization ID */
+                orgId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The outcome of the verification check. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Registrable domain the proof applies to. */
+                        domain: string;
+                        /**
+                         * @description How the domain is proven. `custom-domain` means it matches the organization's own registered custom domain and needs no record; `dns-txt` means the record below must be published.
+                         * @enum {string}
+                         */
+                        method: "custom-domain" | "dns-txt";
+                        /** @description Fully qualified name of the TXT record to publish. */
+                        recordName?: string;
+                        /** @description Value the TXT record must carry. */
+                        recordValue?: string;
+                        /** @description Whether control of the domain is currently proven. */
+                        verified: boolean;
+                        /**
+                         * Format: date-time
+                         * @description When control was last proven. Null while unproven.
+                         */
+                        verifiedAt?: string | null;
+                        /**
+                         * @description Why the last check did not prove control.
+                         * @enum {string}
+                         */
+                        failureReason?: "record_not_found" | "record_mismatch" | "lookup_failed" | "domain_reserved";
+                    };
+                };
+            };
+            /** @description Invalid request body or request param */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Expired JWT token used or insufficient privilege */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Caller lacks the permission key required for this organization */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Result not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Too many attempts for this organization */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+        };
+    };
+}