@opusdns/api 1.214.0 → 1.216.0

package/package.json

@@ -3,7 +3,7 @@
     "@opusdns/api-spec-ts-generator": "^1.6.0"
   },
   "name": "@opusdns/api",
-  "version": "1.214.0",
+  "version": "1.216.0",
   "description": "TypeScript types for the OpusDNS OpenAPI specification",
   "main": "./src/index.ts",
   "module": "./src/index.ts",

package/src/helpers/constants.ts

@@ -3,6 +3,7 @@ import type {
   AllocationMethodType,
   AssignablePublicRole,
   AttributeType,
+  AuthCodeDelivery,
   BatchSortField,
   BatchStatus,
   BillingMode,
@@ -12,6 +13,7 @@ import type {
   BillingTransactionStatus,
   ComplianceStatus,
   ConditionOperator,
+  ConnectedAccountType,
   ContactAttributeSetSortField,
   ContactIncludeField,
   ContactSortField,
@@ -205,6 +207,16 @@ export const ATTRIBUTE_TYPE_VALUES = [
   'uri_template',
 ] as const satisfies ReadonlyArray<AttributeType>;
 
+export const AUTH_CODE_DELIVERY = {
+  RESPONSE: "response",
+  REGISTRANT_EMAIL: "registrant_email",
+} as const satisfies Record<string, AuthCodeDelivery>;
+
+export const AUTH_CODE_DELIVERY_VALUES = [
+  'response',
+  'registrant_email',
+] as const satisfies ReadonlyArray<AuthCodeDelivery>;
+
 export const BATCH_SORT_FIELD = {
   CREATED_ON: "created_on",
   STARTED_AT: "started_at",
@@ -351,6 +363,18 @@ export const CONDITION_OPERATOR_VALUES = [
   'not_in',
 ] as const satisfies ReadonlyArray<ConditionOperator>;
 
+export const CONNECTED_ACCOUNT_TYPE = {
+  DEFAULT: "default",
+  AMS: "ams",
+  RAS: "ras",
+} as const satisfies Record<string, ConnectedAccountType>;
+
+export const CONNECTED_ACCOUNT_TYPE_VALUES = [
+  'default',
+  'ams',
+  'ras',
+] as const satisfies ReadonlyArray<ConnectedAccountType>;
+
 export const CONTACT_ATTRIBUTE_SET_SORT_FIELD = {
   LABEL: "label",
   TLD: "tld",

package/src/helpers/endpoints.ts

@@ -74,6 +74,7 @@ export const DOMAINS_TLD_SPECIFIC_SE_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPO
 export const DOMAINS_TLD_SPECIFIC_WALES_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPOINT = '/v1/domains/tld-specific/wales/{domain_reference}/auth_code/request';
 export const DOMAINS_TRANSFER_ENDPOINT = '/v1/domains/transfer';
 export const DOMAINS_BY_DOMAIN_REFERENCE_ENDPOINT = '/v1/domains/{domain_reference}';
+export const DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT = '/v1/domains/{domain_reference}/auth-code';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT = '/v1/domains/{domain_reference}/dnssec';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT = '/v1/domains/{domain_reference}/dnssec/disable';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT = '/v1/domains/{domain_reference}/dnssec/enable';
@@ -236,6 +237,7 @@ export type Endpoint =
   | typeof DOMAINS_TLD_SPECIFIC_WALES_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPOINT
   | typeof DOMAINS_TRANSFER_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_ENDPOINT
+  | typeof DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT

package/src/helpers/keys.ts

@@ -131,6 +131,7 @@ import type {
   DnsZoneUpdatePayloadData,
   DnsZoneUpdateWorkerPayload,
   DnsZoneVanitySetUpdateRes,
+  DomainAuthCode,
   DomainAvailability,
   DomainAvailabilityError,
   DomainAvailabilityMeta,
@@ -2106,6 +2107,20 @@ export const KEYS_DNS_ZONE_VANITY_SET_UPDATE_RES = [
   KEY_DNS_ZONE_VANITY_SET_UPDATE_RES_ZONE,
 ] as const satisfies (keyof DnsZoneVanitySetUpdateRes)[];
 
+export const KEY_DOMAIN_AUTH_CODE_AUTH_CODE = 'auth_code' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_AUTH_CODE_EXPIRES_ON = 'auth_code_expires_on' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_DELIVERY = 'delivery' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_NAME = 'name' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_RECIPIENTS = 'recipients' satisfies keyof DomainAuthCode;
+
+export const KEYS_DOMAIN_AUTH_CODE = [
+  KEY_DOMAIN_AUTH_CODE_AUTH_CODE,
+  KEY_DOMAIN_AUTH_CODE_AUTH_CODE_EXPIRES_ON,
+  KEY_DOMAIN_AUTH_CODE_DELIVERY,
+  KEY_DOMAIN_AUTH_CODE_NAME,
+  KEY_DOMAIN_AUTH_CODE_RECIPIENTS,
+] as const satisfies (keyof DomainAuthCode)[];
+
 export const KEY_DOMAIN_AVAILABILITY_DOMAIN = 'domain' satisfies keyof DomainAvailability;
 export const KEY_DOMAIN_AVAILABILITY_ERROR = 'error' satisfies keyof DomainAvailability;
 export const KEY_DOMAIN_AVAILABILITY_STATUS = 'status' satisfies keyof DomainAvailability;
@@ -3060,6 +3075,7 @@ export const KEYS_DOMAIN_STATUSES_BASE = [
   KEY_DOMAIN_STATUSES_BASE_SUPPORTED_STATUSES,
 ] as const satisfies (keyof DomainStatusesBase)[];
 
+export const KEY_DOMAIN_SUMMARY_DATA_BY_ACCOUNT_TYPE = 'by_account_type' satisfies keyof DomainSummaryData;
 export const KEY_DOMAIN_SUMMARY_DATA_BY_ORGANIZATION = 'by_organization' satisfies keyof DomainSummaryData;
 export const KEY_DOMAIN_SUMMARY_DATA_BY_STATUS = 'by_status' satisfies keyof DomainSummaryData;
 export const KEY_DOMAIN_SUMMARY_DATA_BY_STATUS_TAG = 'by_status_tag' satisfies keyof DomainSummaryData;
@@ -3068,6 +3084,7 @@ export const KEY_DOMAIN_SUMMARY_DATA_EXPIRING_SOON = 'expiring_soon' satisfies k
 export const KEY_DOMAIN_SUMMARY_DATA_TOTAL_COUNT = 'total_count' satisfies keyof DomainSummaryData;
 
 export const KEYS_DOMAIN_SUMMARY_DATA = [
+  KEY_DOMAIN_SUMMARY_DATA_BY_ACCOUNT_TYPE,
   KEY_DOMAIN_SUMMARY_DATA_BY_ORGANIZATION,
   KEY_DOMAIN_SUMMARY_DATA_BY_STATUS,
   KEY_DOMAIN_SUMMARY_DATA_BY_STATUS_TAG,

package/src/helpers/permissions.ts

@@ -57,6 +57,7 @@ import {
   DOMAIN_FORWARDS_METRICS_USER_AGENT_ENDPOINT,
   DOMAIN_FORWARDS_METRICS_VISITS_BY_KEY_ENDPOINT,
   DOMAIN_SEARCH_SUGGEST_ENDPOINT,
+  DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT,
@@ -618,6 +619,13 @@ export const REQUIRED_PERMISSIONS = {
     patch: [],
     delete: [],
   },
+  [DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT]: {
+    get: [],
+    post: [PUBLIC_PERMISSION.DOMAINS_MANAGE],
+    put: [],
+    patch: [],
+    delete: [],
+  },
   [DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT]: {
     get: [],
     post: [PUBLIC_PERMISSION.DOMAINS_MANAGE],

package/src/helpers/requests.d.ts

@@ -518,6 +518,11 @@ export type PATCH_DomainsByDomainReference_Request = {
 export type PATCH_DomainsByDomainReference_Request_Path = PATCH_DomainsByDomainReference_Request['parameters']['path'];
 export type PATCH_DomainsByDomainReference_Request_Body = PATCH_DomainsByDomainReference_Request['requestBody'];
 
+export type POST_DomainsByDomainReferenceAuthCode_Request = {
+  parameters: operations['request_domain_auth_code_v1_domains__domain_reference__auth_code_post']['parameters'];
+};
+export type POST_DomainsByDomainReferenceAuthCode_Request_Path = POST_DomainsByDomainReferenceAuthCode_Request['parameters']['path'];
+
 export type DELETE_DomainsByDomainReferenceDnssec_Request = {
   parameters: operations['delete_dnssec_v1_domains__domain_reference__dnssec_delete']['parameters'];
 };

package/src/helpers/responses.d.ts

@@ -20,6 +20,7 @@ import type {
   DnsZoneSummary,
   DnsZoneVanitySetUpdateRes,
   Domain,
+  DomainAuthCode,
   DomainAvailabilityList,
   DomainCheck,
   DomainDnssecData,
@@ -1190,6 +1191,14 @@ export type POST_Domains_Response_409 = Problem;
 export type POST_Domains_Response_422 = Problem;
 export type POST_Domains_Response_503 = Problem;
 
+export type POST_DomainsByDomainReferenceAuthCode_Response = POST_DomainsByDomainReferenceAuthCode_Response_200 | POST_DomainsByDomainReferenceAuthCode_Response_400 | POST_DomainsByDomainReferenceAuthCode_Response_404 | POST_DomainsByDomainReferenceAuthCode_Response_422 | POST_DomainsByDomainReferenceAuthCode_Response_502;
+
+export type POST_DomainsByDomainReferenceAuthCode_Response_200 = DomainAuthCode;
+export type POST_DomainsByDomainReferenceAuthCode_Response_400 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_404 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_422 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_502 = Problem;
+
 export type POST_DomainsByDomainReferenceDnssecDisable_Response = POST_DomainsByDomainReferenceDnssecDisable_Response_404 | POST_DomainsByDomainReferenceDnssecDisable_Response_422;
 
 export type POST_DomainsByDomainReferenceDnssecDisable_Response_404 = Problem;

package/src/helpers/schemas.d.ts

@@ -16,6 +16,7 @@ export type AssignablePublicRole = components['schemas']['AssignablePublicRole']
 export type AttributeCondition = components['schemas']['AttributeCondition'];
 export type AttributeType = components['schemas']['AttributeType'];
 export type Auth = components['schemas']['Auth'];
+export type AuthCodeDelivery = components['schemas']['AuthCodeDelivery'];
 export type BatchSortField = components['schemas']['BatchSortField'];
 export type BatchStatus = components['schemas']['BatchStatus'];
 export type BillingMetadata = components['schemas']['BillingMetadata'];
@@ -51,6 +52,7 @@ export type CommandError = components['schemas']['CommandError'];
 export type Communication = components['schemas']['Communication'];
 export type ComplianceStatus = components['schemas']['ComplianceStatus'];
 export type ConditionOperator = components['schemas']['ConditionOperator'];
+export type ConnectedAccountType = components['schemas']['ConnectedAccountType'];
 export type ContactAttestReq = components['schemas']['ContactAttestReq'];
 export type ContactAttestRes = components['schemas']['ContactAttestRes'];
 export type ContactAttestVerificationReq = components['schemas']['ContactAttestVerificationReq'];
@@ -170,6 +172,7 @@ export type DnssecRecordType = components['schemas']['DnssecRecordType'];
 export type DnssecRegistryPublishOutcome = components['schemas']['DnssecRegistryPublishOutcome'];
 export type DnssecStatus = components['schemas']['DnssecStatus'];
 export type DomainAttributeKey = components['schemas']['DomainAttributeKey'];
+export type DomainAuthCode = components['schemas']['DomainAuthCodeResponse'];
 export type DomainAvailability = components['schemas']['DomainAvailability'];
 export type DomainAvailabilityError = components['schemas']['DomainAvailabilityError'];
 export type DomainAvailabilityMeta = components['schemas']['DomainAvailabilityMeta'];

package/src/openapi.yaml

@@ -356,6 +356,12 @@ components:
           title: Client Id
       title: Auth
       type: object
+    AuthCodeDelivery:
+      enum:
+      - response
+      - registrant_email
+      title: AuthCodeDelivery
+      type: string
     BatchSortField:
       enum:
       - created_on
@@ -6616,6 +6622,37 @@ components:
         - operationId
         title: request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post
         type: object
+      - properties:
+          data:
+            anyOf:
+            - $ref: '#/components/schemas/DomainAuthCodeResponse'
+            - type: string
+          headers:
+            additionalProperties:
+              type: string
+            description: Selected response headers
+            title: Headers
+            type: object
+          httpStatus:
+            anyOf:
+            - type: integer
+            - type: 'null'
+            description: HTTP status returned by the underlying API
+            title: Httpstatus
+          operationId:
+            const: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+          status:
+            const: ok
+          truncated:
+            default: false
+            description: True when the gateway capped an oversized payload
+            title: Truncated
+            type: boolean
+        required:
+        - status
+        - operationId
+        title: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+        type: object
       - properties:
           data:
             anyOf:
@@ -8269,6 +8306,21 @@ components:
       - not_in
       title: ConditionOperator
       type: string
+    ConnectedAccountType:
+      description: 'Which domain-lifecycle product family an account bills against,
+        orthogonal to the EPP backend.
+
+
+        DEFAULT = the native `domain_lifecycle` product; AMS = the per-TLD `ams_domain_lifecycle`
+
+        product for domains migrated onto an OpusDNS account; RAS = the mirror / management-fee
+        family.'
+      enum:
+      - default
+      - ams
+      - ras
+      title: ConnectedAccountType
+      type: string
     ContactAttestReq:
       properties:
         attestations:
@@ -11372,6 +11424,45 @@ components:
       - registry_reseller_id
       title: DomainAttributeKey
       type: string
+    DomainAuthCodeResponse:
+      properties:
+        auth_code:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: The auth code, when `delivery` is `response`. Hidden when the
+            caller cannot view the domain's auth codes
+          title: Auth Code
+        auth_code_expires_on:
+          anyOf:
+          - format: date-time
+            type: string
+          - type: 'null'
+          description: When the auth code expires, if the registry limits its validity
+          title: Auth Code Expires On
+        delivery:
+          $ref: '#/components/schemas/AuthCodeDelivery'
+          description: 'Where the auth code ends up: `response` returns it in `auth_code`,
+            `registrant_email` means the registry emails it to the registrant and
+            it never reaches us'
+        name:
+          description: The domain name the auth code belongs to
+          title: Name
+          type: string
+        recipients:
+          anyOf:
+          - items:
+              type: string
+            type: array
+          - type: 'null'
+          description: The addresses the registry sent the auth code to, when it reports
+            them
+          title: Recipients
+      required:
+      - name
+      - delivery
+      title: DomainAuthCodeResponse
+      type: object
     DomainAvailability:
       properties:
         domain:
@@ -13938,6 +14029,16 @@ components:
       type: object
     DomainSummaryData:
       properties:
+        by_account_type:
+          additionalProperties:
+            type: integer
+          description: 'The organization''s domain counts by the type of registry
+            account they are held on (account_type: count), only account types with
+            at least one domain; the types are those of the `account_type` list filter'
+          propertyNames:
+            $ref: '#/components/schemas/ConnectedAccountType'
+          title: By Account Type
+          type: object
         by_organization:
           additionalProperties:
             type: integer
@@ -13978,6 +14079,7 @@ components:
       - by_status
       - by_status_tag
       - by_tld
+      - by_account_type
       - by_organization
       - expiring_soon
       title: DomainSummaryData
@@ -24856,7 +24958,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-10-07-204706
+  version: 2026-10-09-182429
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -33494,6 +33596,48 @@ paths:
             whose `connected_account` field carries the registrar, so domains OpusDNS
             sponsors never match.
           title: Registrar
+      - description: 'Filter domains by the type of the registry account they are
+          held on: `ras` for domains on a registrar-abstraction (RAS) account synced
+          from a connected external registrar, including those whose credential has
+          since been deleted (their `connected_account` is null); `ams` for domains
+          managed on a customer''s own registry accreditation; `default` for all others,
+          manually managed domains included (their accounts are typed `default`).
+          Can be specified multiple times (union of all provided values).'
+        in: query
+        name: account_type
+        required: false
+        schema:
+          anyOf:
+          - items:
+              $ref: '#/components/schemas/ConnectedAccountType'
+            type: array
+          - type: 'null'
+          description: 'Filter domains by the type of the registry account they are
+            held on: `ras` for domains on a registrar-abstraction (RAS) account synced
+            from a connected external registrar, including those whose credential
+            has since been deleted (their `connected_account` is null); `ams` for
+            domains managed on a customer''s own registry accreditation; `default`
+            for all others, manually managed domains included (their accounts are
+            typed `default`). Can be specified multiple times (union of all provided
+            values).'
+          title: Account Type
+      - description: 'How to apply `account_type`: `match_any` keeps the domains on
+          any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none`
+          lists every domain not on a RAS account, and listing every type returns
+          nothing). Has no effect without `account_type`. `match_all` is refused:
+          a domain has exactly one account type.'
+        in: query
+        name: account_type_mode
+        required: false
+        schema:
+          $ref: '#/components/schemas/TagFilterMode'
+          default: match_any
+          description: 'How to apply `account_type`: `match_any` keeps the domains
+            on any of the listed types, `match_none` the domains on none of them (so
+            `account_type=ras&account_type_mode=match_none` lists every domain not
+            on a RAS account, and listing every type returns nothing). Has no effect
+            without `account_type`. `match_all` is refused: a domain has exactly one
+            account type.'
       - description: Extra data to include in each result. `tags` populates the `tags`
           (user tags) and `status_tags` fields, which are otherwise null; filtering
           by `tag_ids` or `status_tags` alone does not populate them. `connected_account`
@@ -33944,9 +34088,10 @@ paths:
   /v1/domains/summary:
     get:
       description: 'Retrieves a summary of your organization''s domains, with counts
-        by status, status tag, TLD and
+        by status, status tag, TLD,
 
-        expiration timeframe. Only `by_organization` includes sub-organizations.'
+        registry account type and expiration timeframe. Only `by_organization` includes
+        sub-organizations.'
       operationId: get_domain_summary_v1_domains_summary_get
       parameters:
       - $ref: '#/components/parameters/DatetimeFormatHeader'
@@ -34032,6 +34177,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/be/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_be__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34099,11 +34247,13 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/cymru/{domain_reference}/auth_code/request:
     post:
-      description: Nominet expires a Transfer Authorisation Code after 14 days or
-        on use in a transfer, and enforces complexity requirements on it. This endpoint
-        mints a compliant code, sets it through a `domain:update` and returns it,
-        invalidating any previous one. It is the only way to change a `.cymru` auth
-        code.
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. Nominet expires a Transfer Authorisation Code after
+        14 days or on use in a transfer, and enforces complexity requirements on it.
+        This endpoint mints a compliant code, sets it through a `domain:update` and
+        returns it, invalidating any previous one. It is the only way to change a
+        `.cymru` auth code.'
       operationId: request_auth_code_v1_domains_tld_specific_cymru__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34171,6 +34321,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/cz/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_cz__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34297,6 +34450,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/dk/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_dk__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34364,6 +34520,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/eu/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_eu__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34431,6 +34590,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/lt/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_lt__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34759,10 +34921,12 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/nu/{domain_reference}/auth_code/request:
     post:
-      description: '`.nu` auth codes are owned by the registry: registrars can only
-        send the literal `auto`, and the generated code is returned in the `iis:updData`
-        extension of a `domain:update`. This endpoint runs that update and stores
-        the fresh code, invalidating any previous one.'
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. `.nu` auth codes are owned by the registry: registrars
+        can only send the literal `auto`, and the generated code is returned in the
+        `iis:updData` extension of a `domain:update`. This endpoint runs that update
+        and stores the fresh code, invalidating any previous one.'
       operationId: request_auth_code_v1_domains_tld_specific_nu__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34830,10 +34994,12 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/se/{domain_reference}/auth_code/request:
     post:
-      description: '`.se` auth codes are owned by the registry: registrars can only
-        send the literal `auto`, and the generated code is returned in the `iis:updData`
-        extension of a `domain:update`. This endpoint runs that update and stores
-        the fresh code, invalidating any previous one.'
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. `.se` auth codes are owned by the registry: registrars
+        can only send the literal `auto`, and the generated code is returned in the
+        `iis:updData` extension of a `domain:update`. This endpoint runs that update
+        and stores the fresh code, invalidating any previous one.'
       operationId: request_auth_code_v1_domains_tld_specific_se__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34901,11 +35067,13 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/wales/{domain_reference}/auth_code/request:
     post:
-      description: Nominet expires a Transfer Authorisation Code after 14 days or
-        on use in a transfer, and enforces complexity requirements on it. This endpoint
-        mints a compliant code, sets it through a `domain:update` and returns it,
-        invalidating any previous one. It is the only way to change a `.wales` auth
-        code.
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. Nominet expires a Transfer Authorisation Code after
+        14 days or on use in a transfer, and enforces complexity requirements on it.
+        This endpoint mints a compliant code, sets it through a `domain:update` and
+        returns it, invalidating any previous one. It is the only way to change a
+        `.wales` auth code.'
       operationId: request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -35338,6 +35506,102 @@ paths:
       - domain
       x-required-permissions:
       - domains:manage
+  /v1/domains/{domain_reference}/auth-code:
+    post:
+      description: Gets the domain a fresh auth code, whatever the registry's model.
+        Where the registrar sets the code, one is generated, set at the registry and
+        returned, invalidating the previous one. Where the registry generates it,
+        it is requested there and returned, or, for registries that only send it to
+        the registrant (`.be`, `.cz`), `delivery` is `registrant_email` and no code
+        is returned. TLDs without auth codes answer 422. `auth_code` is hidden when
+        the caller cannot view the domain's auth codes.
+      operationId: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+      parameters:
+      - in: path
+        name: domain_reference
+        required: true
+        schema:
+          anyOf:
+          - examples:
+            - domain_01h45ytscbebyvny4gc8cr8ma2
+            format: typeid
+            pattern: ^domain_[0-7][0-9a-hjkmnpq-tv-z]{25}$
+            type: string
+            x-typeid-prefix: domain
+          - type: string
+          title: Domain Reference
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DomainAuthCodeResponse'
+          description: Successful Response
+        '400':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_TRANSFER
+                detail: There was an error transferring the domain
+                domain_name: Additional error context.
+                reason: An unspecified error occurred
+                status: 400
+                title: Domain Transfer Error
+                type: domain-transfer
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Bad Request
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_NOT_FOUND
+                detail: Domain not found
+                domain_name: Additional error context.
+                status: 404
+                title: Domain Management Error
+                type: domain-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
+        '422':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_AUTH_CODE_NOT_SUPPORTED
+                detail: Auth codes are not used
+                domain_name: example.lu
+                status: 422
+                title: Domain Management Error
+                tld: lu
+                type: domain-auth-code-not-supported
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unprocessable Content
+        '502':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTH_CODE
+                detail: The registry did not return an auth code
+                domain_name: example.eu
+                reason: No auth code returned
+                status: 502
+                title: Domain Management Error
+                type: domain-auth-code-unavailable
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Bad Gateway
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Request a fresh auth code
+      tags:
+      - domain
+      - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/dnssec:
     delete:
       description: Removes all DNSSEC data for a domain

package/src/schema.d.ts

@@ -1211,8 +1211,8 @@ export interface paths {
         };
         /**
          * Get domain summary
-         * @description Retrieves a summary of your organization's domains, with counts by status, status tag, TLD and
-         *     expiration timeframe. Only `by_organization` includes sub-organizations.
+         * @description Retrieves a summary of your organization's domains, with counts by status, status tag, TLD,
+         *     registry account type and expiration timeframe. Only `by_organization` includes sub-organizations.
          */
         get: operations["get_domain_summary_v1_domains_summary_get"];
         put?: never;
@@ -1249,7 +1249,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from DNS Belgium (registry) */
+        /**
+         * Requests your auth code directly from DNS Belgium (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_be__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1268,7 +1272,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Nominet (.cymru)
-         * @description Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.cymru` auth code.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.cymru` auth code.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_cymru__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1286,7 +1291,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from CZ.NIC (registry) */
+        /**
+         * Requests your auth code directly from CZ.NIC (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_cz__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1320,7 +1329,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from Punktum dk (registry) */
+        /**
+         * Requests your auth code directly from Punktum dk (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_dk__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1337,7 +1350,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from EURid (registry) */
+        /**
+         * Requests your auth code directly from EURid (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_eu__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1354,7 +1371,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from DOMREG (registry) */
+        /**
+         * Requests your auth code directly from DOMREG (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_lt__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1431,7 +1452,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Internetstiftelsen (.nu)
-         * @description `.nu` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. `.nu` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_nu__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1451,7 +1473,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Internetstiftelsen (.se)
-         * @description `.se` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. `.se` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_se__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1471,7 +1494,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Nominet (.wales)
-         * @description Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.wales` auth code.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.wales` auth code.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1537,6 +1561,26 @@ export interface paths {
         patch: operations["update_domain_v1_domains__domain_reference__patch"];
         trace?: never;
     };
+    "/v1/domains/{domain_reference}/auth-code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request a fresh auth code
+         * @description Gets the domain a fresh auth code, whatever the registry's model. Where the registrar sets the code, one is generated, set at the registry and returned, invalidating the previous one. Where the registry generates it, it is requested there and returned, or, for registries that only send it to the registrant (`.be`, `.cz`), `delivery` is `registrant_email` and no code is returned. TLDs without auth codes answer 422. `auth_code` is hidden when the caller cannot view the domain's auth codes.
+         */
+        post: operations["request_domain_auth_code_v1_domains__domain_reference__auth_code_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/domains/{domain_reference}/dnssec": {
         parameters: {
             query?: never;
@@ -3459,6 +3503,11 @@ export interface components {
             /** Client Id */
             client_id?: string | null;
         };
+        /**
+         * AuthCodeDelivery
+         * @enum {string}
+         */
+        AuthCodeDelivery: "response" | "registrant_email";
         /**
          * BatchSortField
          * @enum {string}
@@ -8154,6 +8203,30 @@ export interface components {
              * @default false
              */
             truncated: boolean;
+        } | {
+            data?: components["schemas"]["DomainAuthCodeResponse"] | string;
+            /**
+             * Headers
+             * @description Selected response headers
+             */
+            headers?: {
+                [key: string]: string;
+            };
+            /**
+             * Httpstatus
+             * @description HTTP status returned by the underlying API
+             */
+            httpStatus?: number | null;
+            /** @constant */
+            operationId: "request_domain_auth_code_v1_domains__domain_reference__auth_code_post";
+            /** @constant */
+            status: "ok";
+            /**
+             * Truncated
+             * @description True when the gateway capped an oversized payload
+             * @default false
+             */
+            truncated: boolean;
         } | {
             data?: string;
             /**
@@ -9429,6 +9502,15 @@ export interface components {
          * @enum {string}
          */
         ConditionOperator: "equals" | "not_equals" | "in" | "not_in";
+        /**
+         * ConnectedAccountType
+         * @description Which domain-lifecycle product family an account bills against, orthogonal to the EPP backend.
+         *
+         *     DEFAULT = the native `domain_lifecycle` product; AMS = the per-TLD `ams_domain_lifecycle`
+         *     product for domains migrated onto an OpusDNS account; RAS = the mirror / management-fee family.
+         * @enum {string}
+         */
+        ConnectedAccountType: "default" | "ams" | "ras";
         /** ContactAttestReq */
         ContactAttestReq: {
             /** Attestations */
@@ -11388,6 +11470,31 @@ export interface components {
          * @enum {string}
          */
         DomainAttributeKey: "auto_renew_period" | "music_registrant_attestation" | "nic_it_compliance_confirmation" | "travel_industry_acknowledgement" | "verification_required" | "de_general_request_contact" | "de_abuse_contact" | "nor_id_applicant_version" | "nor_id_applicant_accept_name" | "nor_id_applicant_accept_date" | "nor_id_declaration" | "nor_id_declaration_token" | "punktum_dk_terms_acceptance" | "punktum_dk_tracking_no" | "internet_ee_registrant_agreement" | "promotion" | "promotion_eligibility" | "domain_contact_attributes" | "registry_reseller_id";
+        /** DomainAuthCodeResponse */
+        DomainAuthCodeResponse: {
+            /**
+             * Auth Code
+             * @description The auth code, when `delivery` is `response`. Hidden when the caller cannot view the domain's auth codes
+             */
+            auth_code?: string | null;
+            /**
+             * Auth Code Expires On
+             * @description When the auth code expires, if the registry limits its validity
+             */
+            auth_code_expires_on?: Date | null;
+            /** @description Where the auth code ends up: `response` returns it in `auth_code`, `registrant_email` means the registry emails it to the registrant and it never reaches us */
+            delivery: components["schemas"]["AuthCodeDelivery"];
+            /**
+             * Name
+             * @description The domain name the auth code belongs to
+             */
+            name: string;
+            /**
+             * Recipients
+             * @description The addresses the registry sent the auth code to, when it reports them
+             */
+            recipients?: string[] | null;
+        };
         /** DomainAvailability */
         DomainAvailability: {
             /** Domain */
@@ -13132,6 +13239,13 @@ export interface components {
         };
         /** DomainSummaryData */
         DomainSummaryData: {
+            /**
+             * By Account Type
+             * @description The organization's domain counts by the type of registry account they are held on (account_type: count), only account types with at least one domain; the types are those of the `account_type` list filter
+             */
+            by_account_type: {
+                [key: string]: number;
+            };
             /**
              * By Organization
              * @description Domain counts for the organization and its sub-organizations, by name (name: count), only organizations with at least one domain
@@ -26701,6 +26815,10 @@ export interface operations {
                 registrar_credential_id?: TypeId<"registrar_credential">[] | null;
                 /** @description Filter domains held at an external registrar by that registrar. Can be specified multiple times (union of all provided values); combined with `registrar_credential_id`, both must match. Matches exactly the domains whose `connected_account` field carries the registrar, so domains OpusDNS sponsors never match. */
                 registrar?: components["schemas"]["Registrar"][] | null;
+                /** @description Filter domains by the type of the registry account they are held on: `ras` for domains on a registrar-abstraction (RAS) account synced from a connected external registrar, including those whose credential has since been deleted (their `connected_account` is null); `ams` for domains managed on a customer's own registry accreditation; `default` for all others, manually managed domains included (their accounts are typed `default`). Can be specified multiple times (union of all provided values). */
+                account_type?: components["schemas"]["ConnectedAccountType"][] | null;
+                /** @description How to apply `account_type`: `match_any` keeps the domains on any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none` lists every domain not on a RAS account, and listing every type returns nothing). Has no effect without `account_type`. `match_all` is refused: a domain has exactly one account type. */
+                account_type_mode?: components["schemas"]["TagFilterMode"];
                 /** @description Extra data to include in each result. `tags` populates the `tags` (user tags) and `status_tags` fields, which are otherwise null; filtering by `tag_ids` or `status_tags` alone does not populate them. `connected_account` populates the `connected_account` field for domains held at an external registrar. */
                 include?: components["schemas"]["DomainListIncludeField"][] | null;
             };
@@ -28353,6 +28471,105 @@ export interface operations {
             };
         };
     };
+    request_domain_auth_code_v1_domains__domain_reference__auth_code_post: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Accepted for backwards compatibility; has no effect. Response datetimes are always normalized to UTC and serialized as RFC 3339 with a `Z` suffix, whether or not this header is sent.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path: {
+                domain_reference: TypeId<"domain"> | string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DomainAuthCodeResponse"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_TRANSFER",
+                     *       "detail": "There was an error transferring the domain",
+                     *       "domain_name": "Additional error context.",
+                     *       "reason": "An unspecified error occurred",
+                     *       "status": 400,
+                     *       "title": "Domain Transfer Error",
+                     *       "type": "domain-transfer"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_NOT_FOUND",
+                     *       "detail": "Domain not found",
+                     *       "domain_name": "Additional error context.",
+                     *       "status": 404,
+                     *       "title": "Domain Management Error",
+                     *       "type": "domain-not-found"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Unprocessable Content */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_AUTH_CODE_NOT_SUPPORTED",
+                     *       "detail": "Auth codes are not used",
+                     *       "domain_name": "example.lu",
+                     *       "status": 422,
+                     *       "title": "Domain Management Error",
+                     *       "tld": "lu",
+                     *       "type": "domain-auth-code-not-supported"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Bad Gateway */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_AUTH_CODE",
+                     *       "detail": "The registry did not return an auth code",
+                     *       "domain_name": "example.eu",
+                     *       "reason": "No auth code returned",
+                     *       "status": 502,
+                     *       "title": "Domain Management Error",
+                     *       "type": "domain-auth-code-unavailable"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+        };
+    };
     get_dnssec_v1_domains__domain_reference__dnssec_get: {
         parameters: {
             query?: never;