@opusdns/api 1.159.0 → 1.160.0

package/package.json

@@ -3,7 +3,7 @@
     "@opusdns/api-spec-ts-generator": "^1.5.0"
   },
   "name": "@opusdns/api",
-  "version": "1.159.0",
+  "version": "1.160.0",
   "description": "TypeScript types for the OpusDNS OpenAPI specification",
   "main": "./src/index.ts",
   "module": "./src/index.ts",

package/src/helpers/endpoints.ts

@@ -147,6 +147,9 @@ export const VANITY_NAMESERVER_SETS_BY_SET_ID_RESTORE_ENDPOINT = '/v1/vanity-nam
 export const VANITY_NAMESERVER_SETS_BY_SET_ID_RETRY_ENDPOINT = '/v1/vanity-nameserver-sets/{set_id}/retry';
 export const VANITY_NAMESERVER_SETS_BY_SET_ID_ZONES_ENDPOINT = '/v1/vanity-nameserver-sets/{set_id}/zones';
 export const WHITELABEL_BRANDING_ENDPOINT = '/v1/whitelabel-branding';
+export const WHITELABEL_BRANDING_ASSETS_ENDPOINT = '/v1/whitelabel-branding/assets';
+export const WHITELABEL_BRANDING_ASSETS_BY_ASSET_ID_ENDPOINT = '/v1/whitelabel-branding/assets/{asset_id}';
+export const WHITELABEL_BRANDING_DOCUMENT_ENDPOINT = '/v1/whitelabel-branding/document';
 export const WHITELABEL_BRANDING_EMAIL_PREVIEW_ENDPOINT = '/v1/whitelabel-branding/email/preview';
 export const WHITELABEL_BRANDING_EMAIL_TEMPLATES_ENDPOINT = '/v1/whitelabel-branding/email/templates';
 export const WHITELABEL_BRANDING_RECHECK_ENDPOINT = '/v1/whitelabel-branding/recheck';
@@ -303,6 +306,9 @@ export type Endpoint =
   | typeof VANITY_NAMESERVER_SETS_BY_SET_ID_RETRY_ENDPOINT
   | typeof VANITY_NAMESERVER_SETS_BY_SET_ID_ZONES_ENDPOINT
   | typeof WHITELABEL_BRANDING_ENDPOINT
+  | typeof WHITELABEL_BRANDING_ASSETS_ENDPOINT
+  | typeof WHITELABEL_BRANDING_ASSETS_BY_ASSET_ID_ENDPOINT
+  | typeof WHITELABEL_BRANDING_DOCUMENT_ENDPOINT
   | typeof WHITELABEL_BRANDING_EMAIL_PREVIEW_ENDPOINT
   | typeof WHITELABEL_BRANDING_EMAIL_TEMPLATES_ENDPOINT
   | typeof WHITELABEL_BRANDING_RECHECK_ENDPOINT

package/src/helpers/keys.ts

@@ -13,7 +13,9 @@ import type {
   Auth,
   BillingMetadata,
   BillingTransaction,
+  Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post,
   Brand,
+  BrandingAsset,
   BrandingDocument,
   BrowserStatsBucket,
   BulkObjectTagChanges,
@@ -281,6 +283,7 @@ import type {
   LaunchPhasesBase,
   Legal,
   LegalRequirementBase,
+  ListBrandingAssets,
   ListVanityNameserverSetsRes,
   ListZonesReferencingSetRes,
   LocalPresenceBase,
@@ -645,6 +648,12 @@ export const KEYS_BILLING_TRANSACTION = [
   KEY_BILLING_TRANSACTION_VOLUME,
 ] as const satisfies (keyof BillingTransaction)[];
 
+export const KEY_BODY_UPLOAD_WHITELABEL_ASSET_V1_WHITELABEL_BRANDING_ASSETS_POST_FILE = 'file' satisfies keyof Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post;
+
+export const KEYS_BODY_UPLOAD_WHITELABEL_ASSET_V1_WHITELABEL_BRANDING_ASSETS_POST = [
+  KEY_BODY_UPLOAD_WHITELABEL_ASSET_V1_WHITELABEL_BRANDING_ASSETS_POST_FILE,
+] as const satisfies (keyof Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post)[];
+
 export const KEY_BRAND_LOGO = 'logo' satisfies keyof Brand;
 export const KEY_BRAND_NAME = 'name' satisfies keyof Brand;
 
@@ -653,6 +662,20 @@ export const KEYS_BRAND = [
   KEY_BRAND_NAME,
 ] as const satisfies (keyof Brand)[];
 
+export const KEY_BRANDING_ASSET_ASSET_ID = 'asset_id' satisfies keyof BrandingAsset;
+export const KEY_BRANDING_ASSET_ASSET_URL = 'asset_url' satisfies keyof BrandingAsset;
+export const KEY_BRANDING_ASSET_CONTENT_TYPE = 'content_type' satisfies keyof BrandingAsset;
+export const KEY_BRANDING_ASSET_SIZE_BYTES = 'size_bytes' satisfies keyof BrandingAsset;
+export const KEY_BRANDING_ASSET_UPDATED_ON = 'updated_on' satisfies keyof BrandingAsset;
+
+export const KEYS_BRANDING_ASSET = [
+  KEY_BRANDING_ASSET_ASSET_ID,
+  KEY_BRANDING_ASSET_ASSET_URL,
+  KEY_BRANDING_ASSET_CONTENT_TYPE,
+  KEY_BRANDING_ASSET_SIZE_BYTES,
+  KEY_BRANDING_ASSET_UPDATED_ON,
+] as const satisfies (keyof BrandingAsset)[];
+
 export const KEY_BRANDING_DOCUMENT_AUTH = 'auth' satisfies keyof BrandingDocument;
 export const KEY_BRANDING_DOCUMENT_BRAND = 'brand' satisfies keyof BrandingDocument;
 export const KEY_BRANDING_DOCUMENT_CONTENT = 'content' satisfies keyof BrandingDocument;
@@ -3911,6 +3934,12 @@ export const KEYS_LEGAL_REQUIREMENT_BASE = [
   KEY_LEGAL_REQUIREMENT_BASE_URL,
 ] as const satisfies (keyof LegalRequirementBase)[];
 
+export const KEY_LIST_BRANDING_ASSETS_ASSETS = 'assets' satisfies keyof ListBrandingAssets;
+
+export const KEYS_LIST_BRANDING_ASSETS = [
+  KEY_LIST_BRANDING_ASSETS_ASSETS,
+] as const satisfies (keyof ListBrandingAssets)[];
+
 export const KEY_LIST_VANITY_NAMESERVER_SETS_RES_PAGINATION = 'pagination' satisfies keyof ListVanityNameserverSetsRes;
 export const KEY_LIST_VANITY_NAMESERVER_SETS_RES_RESULTS = 'results' satisfies keyof ListVanityNameserverSetsRes;
 

package/src/helpers/permissions.ts

@@ -150,6 +150,9 @@ import {
   VANITY_NAMESERVER_SETS_CHECK_ENDPOINT,
   VANITY_NAMESERVER_SETS_DEFAULT_ENDPOINT,
   VANITY_NAMESERVER_SETS_ENDPOINT,
+  WHITELABEL_BRANDING_ASSETS_BY_ASSET_ID_ENDPOINT,
+  WHITELABEL_BRANDING_ASSETS_ENDPOINT,
+  WHITELABEL_BRANDING_DOCUMENT_ENDPOINT,
   WHITELABEL_BRANDING_EMAIL_PREVIEW_ENDPOINT,
   WHITELABEL_BRANDING_EMAIL_TEMPLATES_ENDPOINT,
   WHITELABEL_BRANDING_ENDPOINT,
@@ -1260,6 +1263,27 @@ export const REQUIRED_PERMISSIONS = {
     patch: [],
     delete: [],
   },
+  [WHITELABEL_BRANDING_ASSETS_BY_ASSET_ID_ENDPOINT]: {
+    get: [],
+    post: [],
+    put: [],
+    patch: [],
+    delete: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_MANAGE],
+  },
+  [WHITELABEL_BRANDING_ASSETS_ENDPOINT]: {
+    get: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_READ],
+    post: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_MANAGE],
+    put: [],
+    patch: [],
+    delete: [],
+  },
+  [WHITELABEL_BRANDING_DOCUMENT_ENDPOINT]: {
+    get: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_READ],
+    post: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_MANAGE],
+    put: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_MANAGE],
+    patch: [],
+    delete: [],
+  },
   [WHITELABEL_BRANDING_EMAIL_PREVIEW_ENDPOINT]: {
     get: [],
     post: [PUBLIC_PERMISSION.WHITELABEL_BRANDING_MANAGE],

package/src/helpers/requests.d.ts

@@ -1,5 +1,6 @@
 import type { operations } from '../schema';
 import type {
+  BrandingDocument,
   BulkObjectTagChanges,
   ClaimsNoticesRequest,
   ContactAttestReq,
@@ -1191,6 +1192,30 @@ export type PATCH_WhitelabelBranding_Request_Body = PATCH_WhitelabelBranding_Req
 export type POST_WhitelabelBranding_Request = {
 };
 
+export type GET_WhitelabelBrandingAssets_Request = {
+};
+
+export type POST_WhitelabelBrandingAssets_Request = {
+};
+
+export type DELETE_WhitelabelBrandingAssetsByAssetId_Request = {
+  parameters: operations['delete_whitelabel_asset_v1_whitelabel_branding_assets__asset_id__delete']['parameters'];
+};
+export type DELETE_WhitelabelBrandingAssetsByAssetId_Request_Path = DELETE_WhitelabelBrandingAssetsByAssetId_Request['parameters']['path'];
+
+export type GET_WhitelabelBrandingDocument_Request = {
+};
+
+export type POST_WhitelabelBrandingDocument_Request = {
+  requestBody: BrandingDocument;
+};
+export type POST_WhitelabelBrandingDocument_Request_Body = POST_WhitelabelBrandingDocument_Request['requestBody'];
+
+export type PUT_WhitelabelBrandingDocument_Request = {
+  requestBody: BrandingDocument;
+};
+export type PUT_WhitelabelBrandingDocument_Request_Body = PUT_WhitelabelBrandingDocument_Request['requestBody'];
+
 export type POST_WhitelabelBrandingEmailPreview_Request = {
   requestBody: PreviewMailReq;
 };

package/src/helpers/responses.d.ts

@@ -2,6 +2,8 @@ import type {
   AiInferenceUsageSeries,
   AiInferenceUsageSummary,
   BillingTransaction,
+  BrandingAsset,
+  BrandingDocument,
   ClaimsNotices,
   ClearVanityNameserverSetDefaultRes,
   Contact,
@@ -51,6 +53,7 @@ import type {
   Job,
   JobBatchRetry,
   JobBatchStatus,
+  ListBrandingAssets,
   ListVanityNameserverSetsRes,
   ListZonesReferencingSetRes,
   MailTemplateCatalogRes,
@@ -256,6 +259,10 @@ export type DELETE_VanityNameserverSetsDefault_Response = DELETE_VanityNameserve
 export type DELETE_VanityNameserverSetsDefault_Response_200 = ClearVanityNameserverSetDefaultRes;
 export type DELETE_VanityNameserverSetsDefault_Response_422 = HTTPValidationError;
 
+export type DELETE_WhitelabelBrandingAssetsByAssetId_Response = DELETE_WhitelabelBrandingAssetsByAssetId_Response_422;
+
+export type DELETE_WhitelabelBrandingAssetsByAssetId_Response_422 = HTTPValidationError;
+
 export type GET_AiConciergeContextsByContextId_Response = GET_AiConciergeContextsByContextId_Response_401 | GET_AiConciergeContextsByContextId_Response_404 | GET_AiConciergeContextsByContextId_Response_422 | GET_AiConciergeContextsByContextId_Response_502;
 
 export type GET_AiConciergeContextsByContextId_Response_401 = Problem;
@@ -875,6 +882,16 @@ export type GET_WhitelabelBranding_Response = GET_WhitelabelBranding_Response_20
 export type GET_WhitelabelBranding_Response_200 = WhitelabelBranding;
 export type GET_WhitelabelBranding_Response_422 = HTTPValidationError;
 
+export type GET_WhitelabelBrandingAssets_Response = GET_WhitelabelBrandingAssets_Response_200 | GET_WhitelabelBrandingAssets_Response_422;
+
+export type GET_WhitelabelBrandingAssets_Response_200 = ListBrandingAssets;
+export type GET_WhitelabelBrandingAssets_Response_422 = HTTPValidationError;
+
+export type GET_WhitelabelBrandingDocument_Response = GET_WhitelabelBrandingDocument_Response_200 | GET_WhitelabelBrandingDocument_Response_422;
+
+export type GET_WhitelabelBrandingDocument_Response_200 = BrandingDocument;
+export type GET_WhitelabelBrandingDocument_Response_422 = HTTPValidationError;
+
 export type GET_WhitelabelBrandingEmailTemplates_Response = GET_WhitelabelBrandingEmailTemplates_Response_200 | GET_WhitelabelBrandingEmailTemplates_Response_422;
 
 export type GET_WhitelabelBrandingEmailTemplates_Response_200 = MailTemplateCatalogRes;
@@ -1446,6 +1463,16 @@ export type POST_WhitelabelBranding_Response = POST_WhitelabelBranding_Response_
 export type POST_WhitelabelBranding_Response_202 = ProductCreateRes;
 export type POST_WhitelabelBranding_Response_422 = HTTPValidationError;
 
+export type POST_WhitelabelBrandingAssets_Response = POST_WhitelabelBrandingAssets_Response_200 | POST_WhitelabelBrandingAssets_Response_422;
+
+export type POST_WhitelabelBrandingAssets_Response_200 = BrandingAsset;
+export type POST_WhitelabelBrandingAssets_Response_422 = HTTPValidationError;
+
+export type POST_WhitelabelBrandingDocument_Response = POST_WhitelabelBrandingDocument_Response_200 | POST_WhitelabelBrandingDocument_Response_422;
+
+export type POST_WhitelabelBrandingDocument_Response_200 = BrandingDocument;
+export type POST_WhitelabelBrandingDocument_Response_422 = HTTPValidationError;
+
 export type POST_WhitelabelBrandingEmailPreview_Response = POST_WhitelabelBrandingEmailPreview_Response_200 | POST_WhitelabelBrandingEmailPreview_Response_422;
 
 export type POST_WhitelabelBrandingEmailPreview_Response_200 = PreviewMailRes;
@@ -1529,3 +1556,8 @@ export type PUT_UsersByUserIdRole_Response_200 = PublicRoleAssignment;
 export type PUT_UsersByUserIdRole_Response_403 = Problem;
 export type PUT_UsersByUserIdRole_Response_404 = Problem;
 export type PUT_UsersByUserIdRole_Response_422 = HTTPValidationError;
+
+export type PUT_WhitelabelBrandingDocument_Response = PUT_WhitelabelBrandingDocument_Response_200 | PUT_WhitelabelBrandingDocument_Response_422;
+
+export type PUT_WhitelabelBrandingDocument_Response_200 = BrandingDocument;
+export type PUT_WhitelabelBrandingDocument_Response_422 = HTTPValidationError;

package/src/helpers/schemas.d.ts

@@ -25,7 +25,9 @@ export type BillingTransactionProductType = components['schemas']['BillingTransa
 export type BillingTransaction = components['schemas']['BillingTransactionResponse'];
 export type BillingTransactionSortField = components['schemas']['BillingTransactionSortField'];
 export type BillingTransactionStatus = components['schemas']['BillingTransactionStatus'];
+export type Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post = components['schemas']['Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post'];
 export type Brand = components['schemas']['Brand'];
+export type BrandingAsset = components['schemas']['BrandingAsset'];
 export type BrandingDocument = components['schemas']['BrandingDocument'];
 export type BrowserStatsBucket = components['schemas']['BrowserStatsBucket'];
 export type BulkObjectTagChanges = components['schemas']['BulkObjectTagChanges'];
@@ -352,6 +354,7 @@ export type Legal = components['schemas']['Legal'];
 export type LegalRequirementBase = components['schemas']['LegalRequirementBase'];
 export type LegalRequirementOperationType = components['schemas']['LegalRequirementOperationType'];
 export type LegalRequirementType = components['schemas']['LegalRequirementType'];
+export type ListBrandingAssets = components['schemas']['ListBrandingAssetsResponse'];
 export type ListVanityNameserverSetsRes = components['schemas']['ListVanityNameserverSetsRes'];
 export type ListZonesReferencingSetRes = components['schemas']['ListZonesReferencingSetRes'];
 export type LocalPresenceBase = components['schemas']['LocalPresenceBase'];

package/src/openapi.yaml

@@ -536,6 +536,17 @@ components:
       - canceled
       title: BillingTransactionStatus
       type: string
+    Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post:
+      properties:
+        file:
+          contentMediaType: application/octet-stream
+          description: Asset file (image/font)
+          title: File
+          type: string
+      required:
+      - file
+      title: Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post
+      type: object
     Brand:
       properties:
         logo:
@@ -551,6 +562,38 @@ components:
           title: Name
       title: Brand
       type: object
+    BrandingAsset:
+      properties:
+        asset_id:
+          description: Opaque handle used to delete or reference the asset
+          title: Asset Id
+          type: string
+        asset_url:
+          description: Public URL of the asset
+          title: Asset Url
+          type: string
+        content_type:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: MIME type of the asset
+          title: Content Type
+        size_bytes:
+          description: Asset size in bytes
+          title: Size Bytes
+          type: integer
+        updated_on:
+          description: Last-modified timestamp
+          format: date-time
+          title: Updated On
+          type: string
+      required:
+      - asset_id
+      - asset_url
+      - size_bytes
+      - updated_on
+      title: BrandingAsset
+      type: object
     BrandingDocument:
       properties:
         auth:
@@ -9421,6 +9464,16 @@ components:
       - confirmation
       title: LegalRequirementType
       type: string
+    ListBrandingAssetsResponse:
+      properties:
+        assets:
+          description: Uploaded assets, most recent first
+          items:
+            $ref: '#/components/schemas/BrandingAsset'
+          title: Assets
+          type: array
+      title: ListBrandingAssetsResponse
+      type: object
     ListVanityNameserverSetsRes:
       properties:
         pagination:
@@ -9525,12 +9578,7 @@ components:
       title: Logo
       type: object
     MailTemplate:
-      description: 'One editable transactional email template. This is the public
-        catalog entry:
-
-        mail-service''s operational fields (engine, internal, whitelabel, brand_defaults)
-
-        are deliberately not declared, so the response model drops them.'
+      description: One editable transactional email template in the catalog.
       properties:
         blocks:
           additionalProperties:
@@ -9604,12 +9652,8 @@ components:
       title: MailTemplateCatalogRes
       type: object
     MailTemplateCategory:
-      description: 'Category a template is grouped under in the editor. mail-service
-        owns the set
-
-        and validates it; a value it adds before this enum is updated decodes to UNKNOWN
-
-        rather than failing the catalog (see MailTemplate._coerce_category).'
+      description: Category a template is grouped under in the editor. An unrecognised
+        value decodes to `unknown`.
       enum:
       - organization
       - billing
@@ -12180,10 +12224,16 @@ components:
           anyOf:
           - $ref: '#/components/schemas/BrandingDocument'
           - type: 'null'
+          description: Draft branding document to render the preview with; omit to
+            preview with the default OpusDNS branding. Only the fields the template
+            uses are applied, the rest are ignored.
         language_code:
+          description: Locale to render in (e.g. en); falls back to the template's
+            default
           title: Language Code
           type: string
         template_name:
+          description: Template to render, as listed by the template catalog
           title: Template Name
           type: string
       required:
@@ -15299,14 +15349,13 @@ components:
         custom domain is untouched - it is re-pointed by its hostnames through recheck)
         and `enabled`
 
-        starts or stops serving - both applied asynchronously via the reconcile job,
-        neither a purchase.
+        starts or stops serving - both applied asynchronously, neither a purchase.
+        `renewal_mode` sets the
 
-        `renewal_mode` sets the subscription''s auto-renew intent synchronously (EXPIRE
-        = cancel at period
+        subscription''s auto-renew intent synchronously (EXPIRE = cancel at period
+        end, RENEW = un-cancel);
 
-        end, RENEW = un-cancel); it is not a purchase either - no price change. At
-        least one must be given.'
+        it is not a purchase either - no price change. At least one must be given.'
       properties:
         enabled:
           anyOf:
@@ -15646,19 +15695,16 @@ components:
       title: WhitelabelRenewalMode
       type: string
     WhitelabelSubscriptionInfo:
-      description: 'The whitelabel''s billing-lifecycle state, a pass-through read
-        from the subscription at the api
-
-        layer (product-service owns it; the branding row does not). Grouped into its
-        own object so it
+      description: 'The whitelabel''s billing-lifecycle state, grouped into its own
+        block: the parent''s
 
-        reads as one all-or-nothing block: the parent''s `subscription` is null when
-        the config has no live
+        `subscription` is null when the config has no live subscription (still provisioning,
+        or
 
-        subscription (still provisioning, or terminated). renewal_mode EXPIRE + expires_on
-        is how a
+        terminated). A cancelled whitelabel reads as renewal_mode=expire with expires_on
+        set to when
 
-        cancelled whitelabel reads: "cancelled, served until expires_on".'
+        serving stops.'
       properties:
         expires_on:
           anyOf:
@@ -16250,7 +16296,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-09-08-081758
+  version: 2026-09-08-113838
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -34054,6 +34100,179 @@ paths:
       - whitelabel
       x-required-permissions:
       - whitelabel_branding:manage
+  /v1/whitelabel-branding/assets:
+    get:
+      operationId: list_whitelabel_assets_v1_whitelabel_branding_assets_get
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ListBrandingAssetsResponse'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: List uploaded branding assets
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:read
+    post:
+      operationId: upload_whitelabel_asset_v1_whitelabel_branding_assets_post
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/BrandingAsset'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Upload a branding asset
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
+  /v1/whitelabel-branding/assets/{asset_id}:
+    delete:
+      operationId: delete_whitelabel_asset_v1_whitelabel_branding_assets__asset_id__delete
+      parameters:
+      - in: path
+        name: asset_id
+        required: true
+        schema:
+          title: Asset Id
+          type: string
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      responses:
+        '204':
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Delete an uploaded branding asset
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
+  /v1/whitelabel-branding/document:
+    get:
+      operationId: get_whitelabel_document_v1_whitelabel_branding_document_get
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/BrandingDocument'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Get the stored branding document
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:read
+    post:
+      operationId: put_whitelabel_document_v1_whitelabel_branding_document_post
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/BrandingDocument'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/BrandingDocument'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Upsert the branding document
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
+    put:
+      operationId: put_whitelabel_document_v1_whitelabel_branding_document_put
+      parameters:
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/BrandingDocument'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/BrandingDocument'
+          description: Successful Response
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Upsert the branding document
+      tags:
+      - whitelabel
+      x-required-permissions:
+      - whitelabel_branding:manage
   /v1/whitelabel-branding/email/preview:
     post:
       operationId: preview_whitelabel_email_v1_whitelabel_branding_email_preview_post
@@ -34671,16 +34890,19 @@ tags:
     "auth_subdomain": "auth", "period": {...}}`.
 
     A `label` is required for both tiers: every whitelabel keeps a managed subdomain,
-    composed by branding-service as `<label>-<hash>.<base-tier suffix>` and `<label>-<hash>-auth.<base-tier
-    suffix>`, where the hash comes from a per-organization secret it alone holds.
+    composed as `app.<label>.<base-tier suffix>` (dashboard) and `auth.<label>.<base-tier
+    suffix>` (login).
 
-    For base, that composed pair is what gets served; onboarding skips DNS verification
-    and the edge CNAME, because that zone has wildcard DNS and a wildcard certificate.
+    For base, that composed pair is what gets served: onboarding skips domain verification
+    (the zone is OpusDNS-owned) but still points each host at the whitelabel edge,
+    which issues a per-host certificate on demand.
 
     For plus, the customer''s own domain is served instead (omitting `dashboard_subdomain`
     serves the dashboard on the apex); the domain must be an OpusDNS-hosted zone owned
     by the organization, which onboarding verifies before pointing both hosts at the
-    whitelabel edge.
+    whitelabel edge. Set `create_zone: true` to have onboarding stand the zone up
+    if it does not already exist. The managed base pair is published alongside the
+    custom domain as a backup address.
 
     Labels are validated on the way in, and branding-service additionally rejects
     reserved ones (that rejection surfaces as a 400).
@@ -34718,20 +34940,22 @@ tags:
 
 
     A disabled whitelabel answers 409 to both `/recheck` and `/tier`: re-enable it
-    first (`PATCH {"enabled": true}` alone re-runs the reconcile).
+    first (`PATCH {"enabled": true}` alone re-runs onboarding).
 
 
     `PATCH /v1/whitelabel-branding` changes the config without touching its subscription
     or price.
 
-    `{"label": "newname"}` moves a base-tier whitelabel to a different subdomain,
-    accepted only before provisioning has started (a plus whitelabel has no served
-    label - it is re-pointed by its hostnames through recheck).
+    `{"label": "newname"}` moves the managed subdomain to a different label at any
+    time, including while the whitelabel is active. On base this changes the served
+    host; on plus it moves the backup pair, leaving the custom domain unchanged (re-point
+    that through recheck).
 
     `{"enabled": false}` stops serving the whitelabel: its login client is disabled
-    and OpusDNS withdraws its routing - the managed subdomain is unpublished for base,
-    the DNS edge records are removed for plus (a plus host whose DNS is pointed at
-    the edge manually keeps reaching the branded dashboard, but its login stays disabled).
+    and OpusDNS withdraws its routing - the edge records for the served hosts are
+    removed and the managed subdomain unpublished (a plus host whose DNS is still
+    pointed at the edge keeps reaching the branded dashboard, but its login stays
+    disabled).
 
     The configuration, the branding document and the provisioning history are kept,
     so `{"enabled": true}` brings it back without re-provisioning.

package/src/schema.d.ts

@@ -3032,6 +3032,60 @@ export interface paths {
         patch: operations["patch_whitelabel_branding_v1_whitelabel_branding_patch"];
         trace?: never;
     };
+    "/v1/whitelabel-branding/assets": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List uploaded branding assets */
+        get: operations["list_whitelabel_assets_v1_whitelabel_branding_assets_get"];
+        put?: never;
+        /** Upload a branding asset */
+        post: operations["upload_whitelabel_asset_v1_whitelabel_branding_assets_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/whitelabel-branding/assets/{asset_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Delete an uploaded branding asset */
+        delete: operations["delete_whitelabel_asset_v1_whitelabel_branding_assets__asset_id__delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/whitelabel-branding/document": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get the stored branding document */
+        get: operations["get_whitelabel_document_v1_whitelabel_branding_document_get"];
+        /** Upsert the branding document */
+        put: operations["put_whitelabel_document_v1_whitelabel_branding_document_put"];
+        /** Upsert the branding document */
+        post: operations["put_whitelabel_document_v1_whitelabel_branding_document_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/whitelabel-branding/email/preview": {
         parameters: {
             query?: never;
@@ -3456,12 +3510,49 @@ export interface components {
          * @enum {string}
          */
         BillingTransactionStatus: "pending" | "succeeded" | "failed" | "canceled";
+        /** Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post */
+        Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post: {
+            /**
+             * File
+             * @description Asset file (image/font)
+             */
+            file: string;
+        };
         /** Brand */
         Brand: {
             logo?: components["schemas"]["Logo"] | null;
             /** Name */
             name?: string | null;
         };
+        /** BrandingAsset */
+        BrandingAsset: {
+            /**
+             * Asset Id
+             * @description Opaque handle used to delete or reference the asset
+             */
+            asset_id: string;
+            /**
+             * Asset Url
+             * @description Public URL of the asset
+             */
+            asset_url: string;
+            /**
+             * Content Type
+             * @description MIME type of the asset
+             */
+            content_type?: string | null;
+            /**
+             * Size Bytes
+             * @description Asset size in bytes
+             */
+            size_bytes: number;
+            /**
+             * Updated On
+             * Format: date-time
+             * @description Last-modified timestamp
+             */
+            updated_on: Date;
+        };
         /** BrandingDocument */
         BrandingDocument: {
             auth?: components["schemas"]["Auth"] | null;
@@ -9399,6 +9490,14 @@ export interface components {
          * @enum {string}
          */
         LegalRequirementType: "notice" | "confirmation";
+        /** ListBrandingAssetsResponse */
+        ListBrandingAssetsResponse: {
+            /**
+             * Assets
+             * @description Uploaded assets, most recent first
+             */
+            assets?: components["schemas"]["BrandingAsset"][];
+        };
         /** ListVanityNameserverSetsRes */
         ListVanityNameserverSetsRes: {
             /** @description Pagination metadata */
@@ -9462,9 +9561,7 @@ export interface components {
         };
         /**
          * MailTemplate
-         * @description One editable transactional email template. This is the public catalog entry:
-         *     mail-service's operational fields (engine, internal, whitelabel, brand_defaults)
-         *     are deliberately not declared, so the response model drops them.
+         * @description One editable transactional email template in the catalog.
          */
         MailTemplate: {
             /**
@@ -9548,9 +9645,7 @@ export interface components {
         };
         /**
          * MailTemplateCategory
-         * @description Category a template is grouped under in the editor. mail-service owns the set
-         *     and validates it; a value it adds before this enum is updated decodes to UNKNOWN
-         *     rather than failing the catalog (see MailTemplate._coerce_category).
+         * @description Category a template is grouped under in the editor. An unrecognised value decodes to `unknown`.
          * @enum {string}
          */
         MailTemplateCategory: "organization" | "billing" | "user_account" | "icann_policy" | "tld_specific" | "unknown";
@@ -11218,10 +11313,17 @@ export interface components {
         PremiumSourceType: "EPP" | "API" | "CSV" | "manual";
         /** PreviewMailReq */
         PreviewMailReq: {
+            /** @description Draft branding document to render the preview with; omit to preview with the default OpusDNS branding. Only the fields the template uses are applied, the rest are ignored. */
             branding_document?: components["schemas"]["BrandingDocument"] | null;
-            /** Language Code */
+            /**
+             * Language Code
+             * @description Locale to render in (e.g. en); falls back to the template's default
+             */
             language_code: string;
-            /** Template Name */
+            /**
+             * Template Name
+             * @description Template to render, as listed by the template catalog
+             */
             template_name: string;
         };
         /** PreviewMailRes */
@@ -13256,9 +13358,9 @@ export interface components {
          * WhitelabelBrandingPatch
          * @description Public patch body. `label` moves the managed base subdomain to a different label (on plus the
          *     custom domain is untouched - it is re-pointed by its hostnames through recheck) and `enabled`
-         *     starts or stops serving - both applied asynchronously via the reconcile job, neither a purchase.
-         *     `renewal_mode` sets the subscription's auto-renew intent synchronously (EXPIRE = cancel at period
-         *     end, RENEW = un-cancel); it is not a purchase either - no price change. At least one must be given.
+         *     starts or stops serving - both applied asynchronously, neither a purchase. `renewal_mode` sets the
+         *     subscription's auto-renew intent synchronously (EXPIRE = cancel at period end, RENEW = un-cancel);
+         *     it is not a purchase either - no price change. At least one must be given.
          */
         WhitelabelBrandingPatch: {
             /**
@@ -13466,11 +13568,10 @@ export interface components {
         WhitelabelRenewalMode: "renew" | "expire";
         /**
          * WhitelabelSubscriptionInfo
-         * @description The whitelabel's billing-lifecycle state, a pass-through read from the subscription at the api
-         *     layer (product-service owns it; the branding row does not). Grouped into its own object so it
-         *     reads as one all-or-nothing block: the parent's `subscription` is null when the config has no live
-         *     subscription (still provisioning, or terminated). renewal_mode EXPIRE + expires_on is how a
-         *     cancelled whitelabel reads: "cancelled, served until expires_on".
+         * @description The whitelabel's billing-lifecycle state, grouped into its own block: the parent's
+         *     `subscription` is null when the config has no live subscription (still provisioning, or
+         *     terminated). A cancelled whitelabel reads as renewal_mode=expire with expires_on set to when
+         *     serving stops.
          */
         WhitelabelSubscriptionInfo: {
             /**
@@ -28452,6 +28553,228 @@ export interface operations {
             };
         };
     };
+    list_whitelabel_assets_v1_whitelabel_branding_assets_get: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListBrandingAssetsResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    upload_whitelabel_asset_v1_whitelabel_branding_assets_post: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "multipart/form-data": components["schemas"]["Body_upload_whitelabel_asset_v1_whitelabel_branding_assets_post"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BrandingAsset"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    delete_whitelabel_asset_v1_whitelabel_branding_assets__asset_id__delete: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path: {
+                asset_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    get_whitelabel_document_v1_whitelabel_branding_document_get: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BrandingDocument"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    put_whitelabel_document_v1_whitelabel_branding_document_put: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BrandingDocument"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BrandingDocument"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    put_whitelabel_document_v1_whitelabel_branding_document_post: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opt in to RFC 3339 datetime serialization. When set to `rfc3339`, response datetimes are normalized to UTC and serialized with a `Z` suffix. This is opt-in until the announced default cutover date, after which RFC 3339 becomes the default and this header is accepted as a no-op. Any other value or omission uses the current default serialization.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BrandingDocument"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BrandingDocument"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     preview_whitelabel_email_v1_whitelabel_branding_email_preview_post: {
         parameters: {
             query?: never;