@opusdns/api 1.110.0 → 1.111.0

package/package.json

@@ -3,7 +3,7 @@
     "@opusdns/api-spec-ts-generator": "^1.2.0"
   },
   "name": "@opusdns/api",
-  "version": "1.110.0",
+  "version": "1.111.0",
   "description": "TypeScript types for the OpusDNS OpenAPI specification",
   "main": "./src/index.ts",
   "module": "./src/index.ts",

package/src/helpers/constants.ts

@@ -116,6 +116,7 @@ import type {
   VerificationClaimType,
   VerificationDeadlineType,
   VerificationType,
+  WhitelabelBrandingTier,
   WhitelabelOnboardingFailureCode,
   WhitelabelOnboardingFailureType,
   WhitelabelOnboardingStatus,
@@ -211,6 +212,7 @@ export const BILLING_TRANSACTION_ACTION = {
   TRADE: "trade",
   APPLICATION: "application",
   SERVICE_FEE: "service_fee",
+  UPGRADE_FEE: "upgrade_fee",
   WALLET_TOP_UP: "wallet_top_up",
 } as const satisfies Record<string, BillingTransactionAction>;
 
@@ -222,6 +224,7 @@ export const BILLING_TRANSACTION_ACTION_VALUES = [
   'trade',
   'application',
   'service_fee',
+  'upgrade_fee',
   'wallet_top_up',
 ] as const satisfies ReadonlyArray<BillingTransactionAction>;
 
@@ -233,6 +236,7 @@ export const BILLING_TRANSACTION_PRODUCT_TYPE = {
   ACCOUNT_WALLET: "account_wallet",
   VANITY_NAMESERVER: "vanity_nameserver",
   WHITELABEL_BRANDING: "whitelabel_branding",
+  WHITELABEL_BRANDING_PLUS: "whitelabel_branding_plus",
 } as const satisfies Record<string, BillingTransactionProductType>;
 
 export const BILLING_TRANSACTION_PRODUCT_TYPE_VALUES = [
@@ -243,6 +247,7 @@ export const BILLING_TRANSACTION_PRODUCT_TYPE_VALUES = [
   'account_wallet',
   'vanity_nameserver',
   'whitelabel_branding',
+  'whitelabel_branding_plus',
 ] as const satisfies ReadonlyArray<BillingTransactionProductType>;
 
 export const BILLING_TRANSACTION_SORT_FIELD = {
@@ -2066,6 +2071,16 @@ export const VERIFICATION_TYPE_VALUES = [
   'email',
 ] as const satisfies ReadonlyArray<VerificationType>;
 
+export const WHITELABEL_BRANDING_TIER = {
+  BASE: "base",
+  PLUS: "plus",
+} as const satisfies Record<string, WhitelabelBrandingTier>;
+
+export const WHITELABEL_BRANDING_TIER_VALUES = [
+  'base',
+  'plus',
+] as const satisfies ReadonlyArray<WhitelabelBrandingTier>;
+
 export const WHITELABEL_ONBOARDING_FAILURE_CODE = {
   ZONE_NOT_OWNED: "zone_not_owned",
   DELEGATION_MISSING: "delegation_missing",

package/src/helpers/keys.ts

@@ -428,9 +428,12 @@ import type {
   VerificationRegistrantDetails,
   Verification,
   VisitsByKeyBucket,
-  WhitelabelBrandingCreate,
+  WhitelabelBaseCreate,
+  WhitelabelBrandingPatch,
   WhitelabelBrandingRecheck,
   WhitelabelBranding,
+  WhitelabelPlusCreate,
+  WhitelabelUpgradeToPlus,
   WhoisBase,
   ZoneVanitySetUpdate,
   ZonesContext,
@@ -5810,17 +5813,23 @@ export const KEYS_VISITS_BY_KEY_BUCKET = [
   KEY_VISITS_BY_KEY_BUCKET_UNIQUE,
 ] as const satisfies (keyof VisitsByKeyBucket)[];
 
-export const KEY_WHITELABEL_BRANDING_CREATE_AUTH_SUBDOMAIN = 'auth_subdomain' satisfies keyof WhitelabelBrandingCreate;
-export const KEY_WHITELABEL_BRANDING_CREATE_DASHBOARD_SUBDOMAIN = 'dashboard_subdomain' satisfies keyof WhitelabelBrandingCreate;
-export const KEY_WHITELABEL_BRANDING_CREATE_HOSTNAME = 'hostname' satisfies keyof WhitelabelBrandingCreate;
-export const KEY_WHITELABEL_BRANDING_CREATE_PERIOD = 'period' satisfies keyof WhitelabelBrandingCreate;
+export const KEY_WHITELABEL_BASE_CREATE_LABEL = 'label' satisfies keyof WhitelabelBaseCreate;
+export const KEY_WHITELABEL_BASE_CREATE_PERIOD = 'period' satisfies keyof WhitelabelBaseCreate;
+export const KEY_WHITELABEL_BASE_CREATE_TIER = 'tier' satisfies keyof WhitelabelBaseCreate;
 
-export const KEYS_WHITELABEL_BRANDING_CREATE = [
-  KEY_WHITELABEL_BRANDING_CREATE_AUTH_SUBDOMAIN,
-  KEY_WHITELABEL_BRANDING_CREATE_DASHBOARD_SUBDOMAIN,
-  KEY_WHITELABEL_BRANDING_CREATE_HOSTNAME,
-  KEY_WHITELABEL_BRANDING_CREATE_PERIOD,
-] as const satisfies (keyof WhitelabelBrandingCreate)[];
+export const KEYS_WHITELABEL_BASE_CREATE = [
+  KEY_WHITELABEL_BASE_CREATE_LABEL,
+  KEY_WHITELABEL_BASE_CREATE_PERIOD,
+  KEY_WHITELABEL_BASE_CREATE_TIER,
+] as const satisfies (keyof WhitelabelBaseCreate)[];
+
+export const KEY_WHITELABEL_BRANDING_PATCH_ENABLED = 'enabled' satisfies keyof WhitelabelBrandingPatch;
+export const KEY_WHITELABEL_BRANDING_PATCH_LABEL = 'label' satisfies keyof WhitelabelBrandingPatch;
+
+export const KEYS_WHITELABEL_BRANDING_PATCH = [
+  KEY_WHITELABEL_BRANDING_PATCH_ENABLED,
+  KEY_WHITELABEL_BRANDING_PATCH_LABEL,
+] as const satisfies (keyof WhitelabelBrandingPatch)[];
 
 export const KEY_WHITELABEL_BRANDING_RECHECK_AUTH_SUBDOMAIN = 'auth_subdomain' satisfies keyof WhitelabelBrandingRecheck;
 export const KEY_WHITELABEL_BRANDING_RECHECK_DASHBOARD_SUBDOMAIN = 'dashboard_subdomain' satisfies keyof WhitelabelBrandingRecheck;
@@ -5833,7 +5842,9 @@ export const KEYS_WHITELABEL_BRANDING_RECHECK = [
 ] as const satisfies (keyof WhitelabelBrandingRecheck)[];
 
 export const KEY_WHITELABEL_BRANDING_AUTH_HOSTNAME = 'auth_hostname' satisfies keyof WhitelabelBranding;
+export const KEY_WHITELABEL_BRANDING_BASE_LABEL = 'base_label' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_CREATED_ON = 'created_on' satisfies keyof WhitelabelBranding;
+export const KEY_WHITELABEL_BRANDING_ENABLED = 'enabled' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_FAILURE_CODE = 'failure_code' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_FAILURE_DETAIL = 'failure_detail' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_FAILURE_TYPE = 'failure_type' satisfies keyof WhitelabelBranding;
@@ -5841,13 +5852,16 @@ export const KEY_WHITELABEL_BRANDING_HOSTNAME = 'hostname' satisfies keyof White
 export const KEY_WHITELABEL_BRANDING_KEYCLOAK_CLIENT_ID = 'keycloak_client_id' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_ONBOARDING_STATUS = 'onboarding_status' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_ORGANIZATION_ID = 'organization_id' satisfies keyof WhitelabelBranding;
+export const KEY_WHITELABEL_BRANDING_TIER = 'tier' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_UPDATED_ON = 'updated_on' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_VERIFICATION_DOMAIN = 'verification_domain' satisfies keyof WhitelabelBranding;
 export const KEY_WHITELABEL_BRANDING_WHITELABEL_BRANDING_ID = 'whitelabel_branding_id' satisfies keyof WhitelabelBranding;
 
 export const KEYS_WHITELABEL_BRANDING = [
   KEY_WHITELABEL_BRANDING_AUTH_HOSTNAME,
+  KEY_WHITELABEL_BRANDING_BASE_LABEL,
   KEY_WHITELABEL_BRANDING_CREATED_ON,
+  KEY_WHITELABEL_BRANDING_ENABLED,
   KEY_WHITELABEL_BRANDING_FAILURE_CODE,
   KEY_WHITELABEL_BRANDING_FAILURE_DETAIL,
   KEY_WHITELABEL_BRANDING_FAILURE_TYPE,
@@ -5855,11 +5869,38 @@ export const KEYS_WHITELABEL_BRANDING = [
   KEY_WHITELABEL_BRANDING_KEYCLOAK_CLIENT_ID,
   KEY_WHITELABEL_BRANDING_ONBOARDING_STATUS,
   KEY_WHITELABEL_BRANDING_ORGANIZATION_ID,
+  KEY_WHITELABEL_BRANDING_TIER,
   KEY_WHITELABEL_BRANDING_UPDATED_ON,
   KEY_WHITELABEL_BRANDING_VERIFICATION_DOMAIN,
   KEY_WHITELABEL_BRANDING_WHITELABEL_BRANDING_ID,
 ] as const satisfies (keyof WhitelabelBranding)[];
 
+export const KEY_WHITELABEL_PLUS_CREATE_AUTH_SUBDOMAIN = 'auth_subdomain' satisfies keyof WhitelabelPlusCreate;
+export const KEY_WHITELABEL_PLUS_CREATE_DASHBOARD_SUBDOMAIN = 'dashboard_subdomain' satisfies keyof WhitelabelPlusCreate;
+export const KEY_WHITELABEL_PLUS_CREATE_HOSTNAME = 'hostname' satisfies keyof WhitelabelPlusCreate;
+export const KEY_WHITELABEL_PLUS_CREATE_LABEL = 'label' satisfies keyof WhitelabelPlusCreate;
+export const KEY_WHITELABEL_PLUS_CREATE_PERIOD = 'period' satisfies keyof WhitelabelPlusCreate;
+export const KEY_WHITELABEL_PLUS_CREATE_TIER = 'tier' satisfies keyof WhitelabelPlusCreate;
+
+export const KEYS_WHITELABEL_PLUS_CREATE = [
+  KEY_WHITELABEL_PLUS_CREATE_AUTH_SUBDOMAIN,
+  KEY_WHITELABEL_PLUS_CREATE_DASHBOARD_SUBDOMAIN,
+  KEY_WHITELABEL_PLUS_CREATE_HOSTNAME,
+  KEY_WHITELABEL_PLUS_CREATE_LABEL,
+  KEY_WHITELABEL_PLUS_CREATE_PERIOD,
+  KEY_WHITELABEL_PLUS_CREATE_TIER,
+] as const satisfies (keyof WhitelabelPlusCreate)[];
+
+export const KEY_WHITELABEL_UPGRADE_TO_PLUS_AUTH_SUBDOMAIN = 'auth_subdomain' satisfies keyof WhitelabelUpgradeToPlus;
+export const KEY_WHITELABEL_UPGRADE_TO_PLUS_DASHBOARD_SUBDOMAIN = 'dashboard_subdomain' satisfies keyof WhitelabelUpgradeToPlus;
+export const KEY_WHITELABEL_UPGRADE_TO_PLUS_HOSTNAME = 'hostname' satisfies keyof WhitelabelUpgradeToPlus;
+
+export const KEYS_WHITELABEL_UPGRADE_TO_PLUS = [
+  KEY_WHITELABEL_UPGRADE_TO_PLUS_AUTH_SUBDOMAIN,
+  KEY_WHITELABEL_UPGRADE_TO_PLUS_DASHBOARD_SUBDOMAIN,
+  KEY_WHITELABEL_UPGRADE_TO_PLUS_HOSTNAME,
+] as const satisfies (keyof WhitelabelUpgradeToPlus)[];
+
 export const KEY_WHOIS_BASE_WHOIS_SERVER = 'whois_server' satisfies keyof WhoisBase;
 
 export const KEYS_WHOIS_BASE = [

package/src/helpers/requests.d.ts

@@ -55,7 +55,8 @@ import type {
   UserUpdate,
   VanityNameserverSetCreate,
   VanityNsCheckPublicReq,
-  WhitelabelBrandingCreate,
+  WhitelabelBrandingPatch,
+  WhitelabelUpgradeToPlus,
   ZoneVanitySetUpdate,
 } from './schemas';
 
@@ -1151,10 +1152,13 @@ export type DELETE_VanityNameserverSetsDefault_Request = {
 export type GET_WhitelabelBranding_Request = {
 };
 
+export type PATCH_WhitelabelBranding_Request = {
+  requestBody: WhitelabelBrandingPatch;
+};
+export type PATCH_WhitelabelBranding_Request_Body = PATCH_WhitelabelBranding_Request['requestBody'];
+
 export type POST_WhitelabelBranding_Request = {
-  requestBody: WhitelabelBrandingCreate;
 };
-export type POST_WhitelabelBranding_Request_Body = POST_WhitelabelBranding_Request['requestBody'];
 
 export type POST_WhitelabelBrandingEmailPreview_Request = {
   requestBody: PreviewMailReq;
@@ -1166,3 +1170,8 @@ export type GET_WhitelabelBrandingEmailTemplates_Request = {
 
 export type POST_WhitelabelBrandingRecheck_Request = {
 };
+
+export type POST_WhitelabelBrandingTier_Request = {
+  requestBody: WhitelabelUpgradeToPlus;
+};
+export type POST_WhitelabelBrandingTier_Request_Body = POST_WhitelabelBrandingTier_Request['requestBody'];

package/src/helpers/responses.d.ts

@@ -1018,6 +1018,11 @@ export type PATCH_VanityNameserverSetsBySetIdDefault_Response = PATCH_VanityName
 export type PATCH_VanityNameserverSetsBySetIdDefault_Response_200 = SetVanityNameserverSetDefaultRes;
 export type PATCH_VanityNameserverSetsBySetIdDefault_Response_422 = HTTPValidationError;
 
+export type PATCH_WhitelabelBranding_Response = PATCH_WhitelabelBranding_Response_202 | PATCH_WhitelabelBranding_Response_422;
+
+export type PATCH_WhitelabelBranding_Response_202 = WhitelabelBranding;
+export type PATCH_WhitelabelBranding_Response_422 = HTTPValidationError;
+
 export type POST_AiConciergeConversations_Response = POST_AiConciergeConversations_Response_201 | POST_AiConciergeConversations_Response_401 | POST_AiConciergeConversations_Response_404 | POST_AiConciergeConversations_Response_422 | POST_AiConciergeConversations_Response_502;
 
 export type POST_AiConciergeConversations_Response_201 = Conversation;
@@ -1413,6 +1418,11 @@ export type POST_WhitelabelBrandingRecheck_Response = POST_WhitelabelBrandingRec
 export type POST_WhitelabelBrandingRecheck_Response_202 = WhitelabelBranding;
 export type POST_WhitelabelBrandingRecheck_Response_422 = HTTPValidationError;
 
+export type POST_WhitelabelBrandingTier_Response = POST_WhitelabelBrandingTier_Response_202 | POST_WhitelabelBrandingTier_Response_422;
+
+export type POST_WhitelabelBrandingTier_Response_202 = ProductCreateRes;
+export type POST_WhitelabelBrandingTier_Response_422 = HTTPValidationError;
+
 export type PUT_ContactsByContactIdVerification_Response = PUT_ContactsByContactIdVerification_Response_400 | PUT_ContactsByContactIdVerification_Response_401 | PUT_ContactsByContactIdVerification_Response_403 | PUT_ContactsByContactIdVerification_Response_404 | PUT_ContactsByContactIdVerification_Response_422;
 
 export type PUT_ContactsByContactIdVerification_Response_400 = Problem;

package/src/helpers/schemas.d.ts

@@ -569,12 +569,16 @@ export type VerificationRegistrantDetails = components['schemas']['VerificationR
 export type Verification = components['schemas']['VerificationResponse'];
 export type VerificationType = components['schemas']['VerificationType'];
 export type VisitsByKeyBucket = components['schemas']['VisitsByKeyBucket'];
-export type WhitelabelBrandingCreate = components['schemas']['WhitelabelBrandingCreate'];
+export type WhitelabelBaseCreate = components['schemas']['WhitelabelBaseCreate'];
+export type WhitelabelBrandingPatch = components['schemas']['WhitelabelBrandingPatch'];
 export type WhitelabelBrandingRecheck = components['schemas']['WhitelabelBrandingRecheck'];
 export type WhitelabelBranding = components['schemas']['WhitelabelBrandingResponse'];
+export type WhitelabelBrandingTier = components['schemas']['WhitelabelBrandingTier'];
 export type WhitelabelOnboardingFailureCode = components['schemas']['WhitelabelOnboardingFailureCode'];
 export type WhitelabelOnboardingFailureType = components['schemas']['WhitelabelOnboardingFailureType'];
 export type WhitelabelOnboardingStatus = components['schemas']['WhitelabelOnboardingStatus'];
+export type WhitelabelPlusCreate = components['schemas']['WhitelabelPlusCreate'];
+export type WhitelabelUpgradeToPlus = components['schemas']['WhitelabelUpgradeToPlus'];
 export type WhoisBase = components['schemas']['WhoisBase'];
 export type ZoneIncludeField = components['schemas']['ZoneIncludeField'];
 export type ZoneSortField = components['schemas']['ZoneSortField'];

package/src/openapi.yaml

@@ -263,6 +263,7 @@ components:
       - trade
       - application
       - service_fee
+      - upgrade_fee
       - wallet_top_up
       title: BillingTransactionAction
       type: string
@@ -275,6 +276,7 @@ components:
       - account_wallet
       - vanity_nameserver
       - whitelabel_branding
+      - whitelabel_branding_plus
       title: BillingTransactionProductType
       type: string
     BillingTransactionResponse:
@@ -14541,53 +14543,59 @@ components:
       - unique
       title: VisitsByKeyBucket
       type: object
-    WhitelabelBrandingCreate:
-      description: 'Public create request body. The customer supplies their domain
-        plus the subdomains the
-
-        two whitelabel hosts live on; the full hostnames are composed here. `dashboard_subdomain`
-
-        is optional - omitted, the dashboard is served on `hostname` itself (the zone
-        apex when
+    WhitelabelBaseCreate:
+      additionalProperties: false
+      description: 'Create the base tier: served on a managed subdomain composed from
+        `label`.'
+      properties:
+        label:
+          description: Managed-subdomain label; composed into <label>-<hash>.<base-tier
+            suffix>
+          maxLength: 45
+          minLength: 1
+          title: Label
+          type: string
+        period:
+          $ref: '#/components/schemas/Period'
+          description: 'Billing period; offered: 1 month or 1 year'
+        tier:
+          const: base
+          title: Tier
+          type: string
+      required:
+      - tier
+      - label
+      - period
+      title: WhitelabelBaseCreate
+      type: object
+    WhitelabelBrandingPatch:
+      description: 'Public patch body. Neither field is a purchase, so nothing here
+        touches the subscription or
 
-        `hostname` is the bare domain). The owning org comes from auth context, and
+        its price: `label` moves the base subdomain to a different label (base tier
+        only - a plus
 
-        `verification_domain` is derived server-side (the registrable domain of the
-        composed
+        whitelabel is re-pointed by its hostnames through recheck), and `enabled`
+        starts or stops
 
-        dashboard host), so neither is accepted here.'
+        serving it. At least one must be given.'
       properties:
-        auth_subdomain:
-          description: Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
-          maxLength: 255
-          minLength: 1
-          title: Auth Subdomain
-          type: string
-        dashboard_subdomain:
+        enabled:
           anyOf:
-          - maxLength: 255
+          - type: boolean
+          - type: 'null'
+          description: Whether this whitelabel should be served
+          title: Enabled
+        label:
+          anyOf:
+          - maxLength: 45
             minLength: 1
             type: string
           - type: 'null'
-          description: Subdomain the dashboard is served on (e.g. dash -> dash.customer.com);
-            omit for the apex
-          title: Dashboard Subdomain
-        hostname:
-          description: Domain the whitelabel runs under (e.g. customer.com); must
-            be an OpusDNS-hosted zone
-          maxLength: 255
-          minLength: 1
-          title: Hostname
-          type: string
-        period:
-          $ref: '#/components/schemas/Period'
-          description: 'Billing period for the subscription; offered: 1 month or 1
-            year'
-      required:
-      - hostname
-      - auth_subdomain
-      - period
-      title: WhitelabelBrandingCreate
+          description: New base-tier label; the hostnames become <label>-<hash>.<base-tier
+            suffix>. Base tier only.
+          title: Label
+      title: WhitelabelBrandingPatch
       type: object
     WhitelabelBrandingRecheck:
       description: 'Public recheck body. Empty = re-run onboarding against the stored
@@ -14596,10 +14604,10 @@ components:
         fixing DNS). hostname + auth_subdomain present = re-point a wrong domain before
         re-running
 
-        (pre-provisioning only; server rejects once a Keycloak client exists). Same
-        composition
+        (pre-provisioning only; server rejects once a Keycloak client exists). Plus
+        tier only - a
 
-        rules as WhitelabelBrandingCreate.'
+        base whitelabel is re-labelled through PATCH instead.'
       properties:
         auth_subdomain:
           anyOf:
@@ -14632,10 +14640,19 @@ components:
           minLength: 1
           title: Auth Hostname
           type: string
+        base_label:
+          maxLength: 255
+          minLength: 1
+          title: Base Label
+          type: string
         created_on:
           format: date-time
           title: Created On
           type: string
+        enabled:
+          default: true
+          title: Enabled
+          type: boolean
         failure_code:
           anyOf:
           - $ref: '#/components/schemas/WhitelabelOnboardingFailureCode'
@@ -14672,6 +14689,8 @@ components:
           title: Organization Id
           type: string
           x-typeid-prefix: organization
+        tier:
+          $ref: '#/components/schemas/WhitelabelBrandingTier'
         updated_on:
           format: date-time
           title: Updated On
@@ -14692,9 +14711,11 @@ components:
       required:
       - whitelabel_branding_id
       - organization_id
+      - tier
       - onboarding_status
       - hostname
       - auth_hostname
+      - base_label
       - verification_domain
       - keycloak_client_id
       - created_on
@@ -14702,6 +14723,29 @@ components:
       - failure_type
       title: WhitelabelBrandingResponse
       type: object
+    WhitelabelBrandingTier:
+      description: 'Which tier a whitelabel config is on. One config per organization,
+        one tier at a time.
+
+
+        BASE serves the customer on a subdomain of an OpusDNS-owned zone; PLUS serves
+        them on their
+
+        own domain. A whitelabel switches between the two in place (a plan change),
+        so `tier` is a
+
+        mutable attribute of the single config row, never a discriminator between
+        two rows. Deliberately
+
+        stored rather than inferred from the hostname, so a base-zone rename can never
+        re-route the row
+
+        down the wrong onboarding path.'
+      enum:
+      - base
+      - plus
+      title: WhitelabelBrandingTier
+      type: string
     WhitelabelOnboardingFailureCode:
       description: 'Stable, frontend-facing reason a terminal onboarding failure happened.
         The free-text
@@ -14734,6 +14778,99 @@ components:
       - failed
       title: WhitelabelOnboardingStatus
       type: string
+    WhitelabelPlusCreate:
+      additionalProperties: false
+      description: 'Create the plus tier: served on the customer''s own domain; `label`
+        still reserves a base
+
+        subdomain (kept for the redirect/downgrade).'
+      properties:
+        auth_subdomain:
+          description: Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
+          maxLength: 255
+          minLength: 1
+          title: Auth Subdomain
+          type: string
+        dashboard_subdomain:
+          anyOf:
+          - maxLength: 255
+            minLength: 1
+            type: string
+          - type: 'null'
+          description: Subdomain the dashboard is served on (e.g. dash -> dash.customer.com);
+            omit for apex
+          title: Dashboard Subdomain
+        hostname:
+          description: Domain the whitelabel runs under (e.g. customer.com); an OpusDNS-hosted
+            zone owned by the org
+          maxLength: 255
+          minLength: 1
+          title: Hostname
+          type: string
+        label:
+          description: Managed-subdomain label reserved for the redirect/downgrade
+          maxLength: 45
+          minLength: 1
+          title: Label
+          type: string
+        period:
+          $ref: '#/components/schemas/Period'
+          description: 'Billing period; offered: 1 month or 1 year'
+        tier:
+          const: plus
+          title: Tier
+          type: string
+      required:
+      - hostname
+      - auth_subdomain
+      - tier
+      - label
+      - period
+      title: WhitelabelPlusCreate
+      type: object
+    WhitelabelUpgradeToPlus:
+      additionalProperties: false
+      description: 'Upgrade the whitelabel to the plus tier, served on the customer''s
+        own domain. This is NOT a
+
+        term change: the subscription keeps its period and renewal date and simply
+        renews at the plus
+
+        price. A yearly upgrade bills a one-time prorated difference for the remaining
+        whole months; a
+
+        monthly upgrade bills nothing now. Downgrades (plus -> base) are not supported
+        - cancel + rebook
+
+        instead - so this body only ever moves to plus (no tier field, no period).'
+      properties:
+        auth_subdomain:
+          description: Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
+          maxLength: 255
+          minLength: 1
+          title: Auth Subdomain
+          type: string
+        dashboard_subdomain:
+          anyOf:
+          - maxLength: 255
+            minLength: 1
+            type: string
+          - type: 'null'
+          description: Subdomain the dashboard is served on (e.g. dash -> dash.customer.com);
+            omit for apex
+          title: Dashboard Subdomain
+        hostname:
+          description: Domain the whitelabel runs under (e.g. customer.com); an OpusDNS-hosted
+            zone owned by the org
+          maxLength: 255
+          minLength: 1
+          title: Hostname
+          type: string
+      required:
+      - hostname
+      - auth_subdomain
+      title: WhitelabelUpgradeToPlus
+      type: object
     WhoisBase:
       properties:
         whois_server:
@@ -15176,7 +15313,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-08-12-133338
+  version: 2026-08-12-140327
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -32182,6 +32319,37 @@ paths:
       - whitelabel
       x-required-permissions:
       - whitelabel_branding:read
+    patch:
+      operationId: patch_whitelabel_branding_v1_whitelabel_branding_patch
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WhitelabelBrandingPatch'
+        required: true
+      responses:
+        '202':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WhitelabelBrandingResponse'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Change the organization's whitelabel branding config (relabel / enable)
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
     post:
       operationId: create_whitelabel_branding_v1_whitelabel_branding_post
       parameters:
@@ -32190,7 +32358,15 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/WhitelabelBrandingCreate'
+              discriminator:
+                mapping:
+                  base: '#/components/schemas/WhitelabelBaseCreate'
+                  plus: '#/components/schemas/WhitelabelPlusCreate'
+                propertyName: tier
+              oneOf:
+              - $ref: '#/components/schemas/WhitelabelBaseCreate'
+              - $ref: '#/components/schemas/WhitelabelPlusCreate'
+              title: Body
         required: true
       responses:
         '202':
@@ -32208,7 +32384,7 @@ paths:
       security:
       - OAuth2PasswordBearer: []
       - APIKeyHeader: []
-      summary: Create the organization's whitelabel branding config
+      summary: Buy the organization's whitelabel branding (base or plus tier)
       tags:
       - whitelabel
       x-required-permissions:
@@ -32305,6 +32481,39 @@ paths:
       - whitelabel
       x-required-permissions:
       - whitelabel_branding:manage
+  /v1/whitelabel-branding/tier:
+    post:
+      operationId: upgrade_whitelabel_to_plus_v1_whitelabel_branding_tier_post
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WhitelabelUpgradeToPlus'
+        required: true
+      responses:
+        '202':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ProductCreateRes'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Upgrade the whitelabel to the plus tier (served on the customer's own
+        domain)
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
 servers:
 - description: Production environment
   url: https://api.opusdns.com
@@ -32729,10 +32938,94 @@ tags:
 - description: 'Endpoints for managing an organization''s whitelabel branding configuration.
 
 
-    The create body carries the customer''s domain plus subdomains: `{"hostname":
-    "customer.com", "dashboard_subdomain": "dash", "auth_subdomain": "auth"}` composes
-    `dash.customer.com` and `auth.customer.com`; omitting `dashboard_subdomain` serves
-    the dashboard on the domain apex itself.
+    An organization has one whitelabel config, on one tier at a time.
+
+    `GET /v1/whitelabel-branding` returns it, or `404` when nothing is set up.
+
+
+    The **base** tier serves the customer on a subdomain of a zone OpusDNS owns, so
+    it needs nothing from them but a name.
+
+    The **plus** tier serves them on their own domain for the fully unbranded experience.
+
+
+    `POST /v1/whitelabel-branding` buys a whitelabel on the chosen tier: `{"tier":
+    "base", "label": "acme", "period": {"value": 1, "unit": "y"}}`, or for plus `{"tier":
+    "plus", "label": "acme", "hostname": "customer.com", "dashboard_subdomain": "dash",
+    "auth_subdomain": "auth", "period": {...}}`.
+
+    A `label` is required for both tiers: every whitelabel keeps a managed subdomain,
+    composed by branding-service as `<label>-<hash>.<base-tier suffix>` and `<label>-<hash>-auth.<base-tier
+    suffix>`, where the hash comes from a per-organization secret it alone holds.
+
+    For base, that composed pair is what gets served; onboarding skips DNS verification
+    and the edge CNAME, because that zone has wildcard DNS and a wildcard certificate.
+
+    For plus, the customer''s own domain is served instead (omitting `dashboard_subdomain`
+    serves the dashboard on the apex); the domain must be an OpusDNS-hosted zone owned
+    by the organization, which onboarding verifies before pointing both hosts at the
+    whitelabel edge.
+
+    Labels are validated on the way in, and branding-service additionally rejects
+    reserved ones (that rejection surfaces as a 400).
+
+    Because every whitelabel composes its label, both tiers are only purchasable in
+    environments configured with a base-tier zone; elsewhere create answers 403.
+
+
+    Both tiers are paid, and a whitelabel is a single subscription: the tiers are
+    alternatives, not add-ons.
+
+
+    `POST /v1/whitelabel-branding/tier` upgrades a base whitelabel to plus in place,
+    with the plus create''s domain fields (`hostname`, `dashboard_subdomain`, `auth_subdomain`
+    - no `tier`, no `period`).
+
+    The subscription keeps its term and renewal date and simply renews at the plus
+    price; a yearly term additionally settles a one-time prorated fee for the remaining
+    whole months now, a monthly term pays nothing now.
+
+    The managed subdomain label is kept.
+
+    Downgrades are not offered (cancel and rebook instead), so a whitelabel already
+    on plus answers 409.
+
+
+    `POST /v1/whitelabel-branding/recheck` re-runs onboarding - the customer''s retry
+    after fixing their DNS setup.
+
+    A plus recheck may also carry a corrected `hostname` plus subdomains to re-point
+    the config before re-running, which is accepted only before provisioning has started.
+
+    A base whitelabel takes no repoint: its hostnames come from its label, so it is
+    moved with `PATCH` instead.
+
+
+    A disabled whitelabel answers 409 to both `/recheck` and `/tier`: re-enable it
+    first (`PATCH {"enabled": true}` alone re-runs the reconcile).
+
+
+    `PATCH /v1/whitelabel-branding` changes the config without touching its subscription
+    or price.
+
+    `{"label": "newname"}` moves a base-tier whitelabel to a different subdomain,
+    accepted only before provisioning has started (a plus whitelabel has no served
+    label - it is re-pointed by its hostnames through recheck).
+
+    `{"enabled": false}` stops serving the whitelabel: its login client is disabled
+    and OpusDNS withdraws its routing - the managed subdomain is unpublished for base,
+    the DNS edge records are removed for plus (a plus host whose DNS is pointed at
+    the edge manually keeps reaching the branded dashboard, but its login stays disabled).
+
+    The configuration, the branding document and the provisioning history are kept,
+    so `{"enabled": true}` brings it back without re-provisioning.
+
+    Like the other write routes this is asynchronous: the response is `202` once the
+    change is recorded, and a job converges the login client and the routing to it
+    shortly after.
+
+    Disabling a whitelabel does **not** cancel its subscription; billing continues
+    until the subscription itself is cancelled.
 
     '
   name: whitelabel

package/src/schema.d.ts

@@ -2937,12 +2937,13 @@ export interface paths {
         /** Get the organization's whitelabel branding config */
         get: operations["get_whitelabel_branding_v1_whitelabel_branding_get"];
         put?: never;
-        /** Create the organization's whitelabel branding config */
+        /** Buy the organization's whitelabel branding (base or plus tier) */
         post: operations["create_whitelabel_branding_v1_whitelabel_branding_post"];
         delete?: never;
         options?: never;
         head?: never;
-        patch?: never;
+        /** Change the organization's whitelabel branding config (relabel / enable) */
+        patch: operations["patch_whitelabel_branding_v1_whitelabel_branding_patch"];
         trace?: never;
     };
     "/v1/whitelabel-branding/email/preview": {
@@ -2996,6 +2997,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/whitelabel-branding/tier": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Upgrade the whitelabel to the plus tier (served on the customer's own domain) */
+        post: operations["upgrade_whitelabel_to_plus_v1_whitelabel_branding_tier_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -3164,12 +3182,12 @@ export interface components {
          * BillingTransactionAction
          * @enum {string}
          */
-        BillingTransactionAction: "create" | "transfer" | "renew" | "restore" | "trade" | "application" | "service_fee" | "wallet_top_up";
+        BillingTransactionAction: "create" | "transfer" | "renew" | "restore" | "trade" | "application" | "service_fee" | "upgrade_fee" | "wallet_top_up";
         /**
          * BillingTransactionProductType
          * @enum {string}
          */
-        BillingTransactionProductType: "domain" | "zones" | "email_forward" | "domain_forward" | "account_wallet" | "vanity_nameserver" | "whitelabel_branding";
+        BillingTransactionProductType: "domain" | "zones" | "email_forward" | "domain_forward" | "account_wallet" | "vanity_nameserver" | "whitelabel_branding" | "whitelabel_branding_plus";
         /** BillingTransactionResponse */
         BillingTransactionResponse: {
             /** @description The action performed in the transaction */
@@ -12580,39 +12598,48 @@ export interface components {
             unique: number;
         };
         /**
-         * WhitelabelBrandingCreate
-         * @description Public create request body. The customer supplies their domain plus the subdomains the
-         *     two whitelabel hosts live on; the full hostnames are composed here. `dashboard_subdomain`
-         *     is optional - omitted, the dashboard is served on `hostname` itself (the zone apex when
-         *     `hostname` is the bare domain). The owning org comes from auth context, and
-         *     `verification_domain` is derived server-side (the registrable domain of the composed
-         *     dashboard host), so neither is accepted here.
+         * WhitelabelBaseCreate
+         * @description Create the base tier: served on a managed subdomain composed from `label`.
          */
-        WhitelabelBrandingCreate: {
+        WhitelabelBaseCreate: {
             /**
-             * Auth Subdomain
-             * @description Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
+             * Label
+             * @description Managed-subdomain label; composed into <label>-<hash>.<base-tier suffix>
              */
-            auth_subdomain: string;
+            label: string;
+            /** @description Billing period; offered: 1 month or 1 year */
+            period: components["schemas"]["Period"];
             /**
-             * Dashboard Subdomain
-             * @description Subdomain the dashboard is served on (e.g. dash -> dash.customer.com); omit for the apex
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
              */
-            dashboard_subdomain?: string | null;
+            tier: "base";
+        };
+        /**
+         * WhitelabelBrandingPatch
+         * @description Public patch body. Neither field is a purchase, so nothing here touches the subscription or
+         *     its price: `label` moves the base subdomain to a different label (base tier only - a plus
+         *     whitelabel is re-pointed by its hostnames through recheck), and `enabled` starts or stops
+         *     serving it. At least one must be given.
+         */
+        WhitelabelBrandingPatch: {
             /**
-             * Hostname
-             * @description Domain the whitelabel runs under (e.g. customer.com); must be an OpusDNS-hosted zone
+             * Enabled
+             * @description Whether this whitelabel should be served
              */
-            hostname: string;
-            /** @description Billing period for the subscription; offered: 1 month or 1 year */
-            period: components["schemas"]["Period"];
+            enabled?: boolean | null;
+            /**
+             * Label
+             * @description New base-tier label; the hostnames become <label>-<hash>.<base-tier suffix>. Base tier only.
+             */
+            label?: string | null;
         };
         /**
          * WhitelabelBrandingRecheck
          * @description Public recheck body. Empty = re-run onboarding against the stored hosts (retry after
          *     fixing DNS). hostname + auth_subdomain present = re-point a wrong domain before re-running
-         *     (pre-provisioning only; server rejects once a Keycloak client exists). Same composition
-         *     rules as WhitelabelBrandingCreate.
+         *     (pre-provisioning only; server rejects once a Keycloak client exists). Plus tier only - a
+         *     base whitelabel is re-labelled through PATCH instead.
          */
         WhitelabelBrandingRecheck: {
             /** Auth Subdomain */
@@ -12629,11 +12656,18 @@ export interface components {
         WhitelabelBrandingResponse: {
             /** Auth Hostname */
             auth_hostname: string;
+            /** Base Label */
+            base_label: string;
             /**
              * Created On
              * Format: date-time
              */
             created_on: Date;
+            /**
+             * Enabled
+             * @default true
+             */
+            enabled: boolean;
             failure_code?: components["schemas"]["WhitelabelOnboardingFailureCode"] | null;
             /** Failure Detail */
             failure_detail?: string | null;
@@ -12649,6 +12683,7 @@ export interface components {
              * @example organization_01h45ytscbebyvny4gc8cr8ma2
              */
             organization_id: TypeId<"organization">;
+            tier: components["schemas"]["WhitelabelBrandingTier"];
             /**
              * Updated On
              * Format: date-time
@@ -12663,6 +12698,18 @@ export interface components {
              */
             whitelabel_branding_id: TypeId<"wlb">;
         };
+        /**
+         * WhitelabelBrandingTier
+         * @description Which tier a whitelabel config is on. One config per organization, one tier at a time.
+         *
+         *     BASE serves the customer on a subdomain of an OpusDNS-owned zone; PLUS serves them on their
+         *     own domain. A whitelabel switches between the two in place (a plan change), so `tier` is a
+         *     mutable attribute of the single config row, never a discriminator between two rows. Deliberately
+         *     stored rather than inferred from the hostname, so a base-zone rename can never re-route the row
+         *     down the wrong onboarding path.
+         * @enum {string}
+         */
+        WhitelabelBrandingTier: "base" | "plus";
         /**
          * WhitelabelOnboardingFailureCode
          * @description Stable, frontend-facing reason a terminal onboarding failure happened. The free-text
@@ -12680,6 +12727,65 @@ export interface components {
          * @enum {string}
          */
         WhitelabelOnboardingStatus: "pending_domain_verification" | "verifying" | "provisioning" | "active" | "failed";
+        /**
+         * WhitelabelPlusCreate
+         * @description Create the plus tier: served on the customer's own domain; `label` still reserves a base
+         *     subdomain (kept for the redirect/downgrade).
+         */
+        WhitelabelPlusCreate: {
+            /**
+             * Auth Subdomain
+             * @description Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
+             */
+            auth_subdomain: string;
+            /**
+             * Dashboard Subdomain
+             * @description Subdomain the dashboard is served on (e.g. dash -> dash.customer.com); omit for apex
+             */
+            dashboard_subdomain?: string | null;
+            /**
+             * Hostname
+             * @description Domain the whitelabel runs under (e.g. customer.com); an OpusDNS-hosted zone owned by the org
+             */
+            hostname: string;
+            /**
+             * Label
+             * @description Managed-subdomain label reserved for the redirect/downgrade
+             */
+            label: string;
+            /** @description Billing period; offered: 1 month or 1 year */
+            period: components["schemas"]["Period"];
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            tier: "plus";
+        };
+        /**
+         * WhitelabelUpgradeToPlus
+         * @description Upgrade the whitelabel to the plus tier, served on the customer's own domain. This is NOT a
+         *     term change: the subscription keeps its period and renewal date and simply renews at the plus
+         *     price. A yearly upgrade bills a one-time prorated difference for the remaining whole months; a
+         *     monthly upgrade bills nothing now. Downgrades (plus -> base) are not supported - cancel + rebook
+         *     instead - so this body only ever moves to plus (no tier field, no period).
+         */
+        WhitelabelUpgradeToPlus: {
+            /**
+             * Auth Subdomain
+             * @description Subdomain the Keycloak login is served on (e.g. auth -> auth.customer.com)
+             */
+            auth_subdomain: string;
+            /**
+             * Dashboard Subdomain
+             * @description Subdomain the dashboard is served on (e.g. dash -> dash.customer.com); omit for apex
+             */
+            dashboard_subdomain?: string | null;
+            /**
+             * Hostname
+             * @description Domain the whitelabel runs under (e.g. customer.com); an OpusDNS-hosted zone owned by the org
+             */
+            hostname: string;
+        };
         /** WhoisBase */
         WhoisBase: {
             /**
@@ -27050,7 +27156,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["WhitelabelBrandingCreate"];
+                "application/json": components["schemas"]["WhitelabelBaseCreate"] | components["schemas"]["WhitelabelPlusCreate"];
             };
         };
         responses: {
@@ -27074,6 +27180,45 @@ export interface operations {
             };
         };
     };
+    patch_whitelabel_branding_v1_whitelabel_branding_patch: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WhitelabelBrandingPatch"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WhitelabelBrandingResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     preview_whitelabel_email_v1_whitelabel_branding_email_preview_post: {
         parameters: {
             query?: never;
@@ -27187,4 +27332,43 @@ export interface operations {
             };
         };
     };
+    upgrade_whitelabel_to_plus_v1_whitelabel_branding_tier_post: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WhitelabelUpgradeToPlus"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProductCreateRes"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
 }