@opusdns/api 1.215.0 → 1.217.0

package/package.json

@@ -3,7 +3,7 @@
     "@opusdns/api-spec-ts-generator": "^1.6.0"
   },
   "name": "@opusdns/api",
-  "version": "1.215.0",
+  "version": "1.217.0",
   "description": "TypeScript types for the OpusDNS OpenAPI specification",
   "main": "./src/index.ts",
   "module": "./src/index.ts",

package/src/helpers/constants.ts

@@ -1,8 +1,10 @@
 import type {
+  AccountTypeFilterMode,
   AgreementType,
   AllocationMethodType,
   AssignablePublicRole,
   AttributeType,
+  AuthCodeDelivery,
   BatchSortField,
   BatchStatus,
   BillingMode,
@@ -144,6 +146,16 @@ import type {
   ZoneSortField,
 } from './schemas';
 
+export const ACCOUNT_TYPE_FILTER_MODE = {
+  MATCH_ANY: "match_any",
+  MATCH_NONE: "match_none",
+} as const satisfies Record<string, AccountTypeFilterMode>;
+
+export const ACCOUNT_TYPE_FILTER_MODE_VALUES = [
+  'match_any',
+  'match_none',
+] as const satisfies ReadonlyArray<AccountTypeFilterMode>;
+
 export const AGREEMENT_TYPE = {
   TERMS_AND_CONDITIONS: "terms_and_conditions",
   MASTER_SERVICE_AGREEMENT: "master_service_agreement",
@@ -206,6 +218,16 @@ export const ATTRIBUTE_TYPE_VALUES = [
   'uri_template',
 ] as const satisfies ReadonlyArray<AttributeType>;
 
+export const AUTH_CODE_DELIVERY = {
+  RESPONSE: "response",
+  REGISTRANT_EMAIL: "registrant_email",
+} as const satisfies Record<string, AuthCodeDelivery>;
+
+export const AUTH_CODE_DELIVERY_VALUES = [
+  'response',
+  'registrant_email',
+] as const satisfies ReadonlyArray<AuthCodeDelivery>;
+
 export const BATCH_SORT_FIELD = {
   CREATED_ON: "created_on",
   STARTED_AT: "started_at",

package/src/helpers/endpoints.ts

@@ -74,6 +74,7 @@ export const DOMAINS_TLD_SPECIFIC_SE_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPO
 export const DOMAINS_TLD_SPECIFIC_WALES_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPOINT = '/v1/domains/tld-specific/wales/{domain_reference}/auth_code/request';
 export const DOMAINS_TRANSFER_ENDPOINT = '/v1/domains/transfer';
 export const DOMAINS_BY_DOMAIN_REFERENCE_ENDPOINT = '/v1/domains/{domain_reference}';
+export const DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT = '/v1/domains/{domain_reference}/auth-code';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT = '/v1/domains/{domain_reference}/dnssec';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT = '/v1/domains/{domain_reference}/dnssec/disable';
 export const DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT = '/v1/domains/{domain_reference}/dnssec/enable';
@@ -236,6 +237,7 @@ export type Endpoint =
   | typeof DOMAINS_TLD_SPECIFIC_WALES_BY_DOMAIN_REFERENCE_AUTH_CODE_REQUEST_ENDPOINT
   | typeof DOMAINS_TRANSFER_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_ENDPOINT
+  | typeof DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT
   | typeof DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT

package/src/helpers/keys.ts

@@ -131,6 +131,7 @@ import type {
   DnsZoneUpdatePayloadData,
   DnsZoneUpdateWorkerPayload,
   DnsZoneVanitySetUpdateRes,
+  DomainAuthCode,
   DomainAvailability,
   DomainAvailabilityError,
   DomainAvailabilityMeta,
@@ -2106,6 +2107,20 @@ export const KEYS_DNS_ZONE_VANITY_SET_UPDATE_RES = [
   KEY_DNS_ZONE_VANITY_SET_UPDATE_RES_ZONE,
 ] as const satisfies (keyof DnsZoneVanitySetUpdateRes)[];
 
+export const KEY_DOMAIN_AUTH_CODE_AUTH_CODE = 'auth_code' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_AUTH_CODE_EXPIRES_ON = 'auth_code_expires_on' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_DELIVERY = 'delivery' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_NAME = 'name' satisfies keyof DomainAuthCode;
+export const KEY_DOMAIN_AUTH_CODE_RECIPIENTS = 'recipients' satisfies keyof DomainAuthCode;
+
+export const KEYS_DOMAIN_AUTH_CODE = [
+  KEY_DOMAIN_AUTH_CODE_AUTH_CODE,
+  KEY_DOMAIN_AUTH_CODE_AUTH_CODE_EXPIRES_ON,
+  KEY_DOMAIN_AUTH_CODE_DELIVERY,
+  KEY_DOMAIN_AUTH_CODE_NAME,
+  KEY_DOMAIN_AUTH_CODE_RECIPIENTS,
+] as const satisfies (keyof DomainAuthCode)[];
+
 export const KEY_DOMAIN_AVAILABILITY_DOMAIN = 'domain' satisfies keyof DomainAvailability;
 export const KEY_DOMAIN_AVAILABILITY_ERROR = 'error' satisfies keyof DomainAvailability;
 export const KEY_DOMAIN_AVAILABILITY_STATUS = 'status' satisfies keyof DomainAvailability;

package/src/helpers/permissions.ts

@@ -57,6 +57,7 @@ import {
   DOMAIN_FORWARDS_METRICS_USER_AGENT_ENDPOINT,
   DOMAIN_FORWARDS_METRICS_VISITS_BY_KEY_ENDPOINT,
   DOMAIN_SEARCH_SUGGEST_ENDPOINT,
+  DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENABLE_ENDPOINT,
   DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_ENDPOINT,
@@ -618,6 +619,13 @@ export const REQUIRED_PERMISSIONS = {
     patch: [],
     delete: [],
   },
+  [DOMAINS_BY_DOMAIN_REFERENCE_AUTH_CODE_ENDPOINT]: {
+    get: [],
+    post: [PUBLIC_PERMISSION.DOMAINS_MANAGE],
+    put: [],
+    patch: [],
+    delete: [],
+  },
   [DOMAINS_BY_DOMAIN_REFERENCE_DNSSEC_DISABLE_ENDPOINT]: {
     get: [],
     post: [PUBLIC_PERMISSION.DOMAINS_MANAGE],

package/src/helpers/requests.d.ts

@@ -518,6 +518,11 @@ export type PATCH_DomainsByDomainReference_Request = {
 export type PATCH_DomainsByDomainReference_Request_Path = PATCH_DomainsByDomainReference_Request['parameters']['path'];
 export type PATCH_DomainsByDomainReference_Request_Body = PATCH_DomainsByDomainReference_Request['requestBody'];
 
+export type POST_DomainsByDomainReferenceAuthCode_Request = {
+  parameters: operations['request_domain_auth_code_v1_domains__domain_reference__auth_code_post']['parameters'];
+};
+export type POST_DomainsByDomainReferenceAuthCode_Request_Path = POST_DomainsByDomainReferenceAuthCode_Request['parameters']['path'];
+
 export type DELETE_DomainsByDomainReferenceDnssec_Request = {
   parameters: operations['delete_dnssec_v1_domains__domain_reference__dnssec_delete']['parameters'];
 };
@@ -592,7 +597,9 @@ export type GET_DomainsStatistics_Request = {
 export type GET_DomainsStatistics_Request_Query = GET_DomainsStatistics_Request['parameters']['query'];
 
 export type GET_DomainsSummary_Request = {
+  parameters: operations['get_domain_summary_v1_domains_summary_get']['parameters'];
 };
+export type GET_DomainsSummary_Request_Query = GET_DomainsSummary_Request['parameters']['query'];
 
 export type POST_DomainsTldSpecificAtByDomainReferenceWithdraw_Request = {
   parameters: operations['withdraw_domain_v1_domains_tld_specific_at__domain_reference__withdraw_post']['parameters'];

package/src/helpers/responses.d.ts

@@ -20,6 +20,7 @@ import type {
   DnsZoneSummary,
   DnsZoneVanitySetUpdateRes,
   Domain,
+  DomainAuthCode,
   DomainAvailabilityList,
   DomainCheck,
   DomainDnssecData,
@@ -1190,6 +1191,14 @@ export type POST_Domains_Response_409 = Problem;
 export type POST_Domains_Response_422 = Problem;
 export type POST_Domains_Response_503 = Problem;
 
+export type POST_DomainsByDomainReferenceAuthCode_Response = POST_DomainsByDomainReferenceAuthCode_Response_200 | POST_DomainsByDomainReferenceAuthCode_Response_400 | POST_DomainsByDomainReferenceAuthCode_Response_404 | POST_DomainsByDomainReferenceAuthCode_Response_422 | POST_DomainsByDomainReferenceAuthCode_Response_502;
+
+export type POST_DomainsByDomainReferenceAuthCode_Response_200 = DomainAuthCode;
+export type POST_DomainsByDomainReferenceAuthCode_Response_400 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_404 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_422 = Problem;
+export type POST_DomainsByDomainReferenceAuthCode_Response_502 = Problem;
+
 export type POST_DomainsByDomainReferenceDnssecDisable_Response = POST_DomainsByDomainReferenceDnssecDisable_Response_404 | POST_DomainsByDomainReferenceDnssecDisable_Response_422;
 
 export type POST_DomainsByDomainReferenceDnssecDisable_Response_404 = Problem;

package/src/helpers/schemas.d.ts

@@ -1,5 +1,6 @@
 import { components } from '../schema';
 
+export type AccountTypeFilterMode = components['schemas']['AccountTypeFilterMode'];
 export type AggregationResult = components['schemas']['AggregationResult'];
 export type AggregationRow = components['schemas']['AggregationRow'];
 export type AggregationsContext = components['schemas']['AggregationsContext'];
@@ -16,6 +17,7 @@ export type AssignablePublicRole = components['schemas']['AssignablePublicRole']
 export type AttributeCondition = components['schemas']['AttributeCondition'];
 export type AttributeType = components['schemas']['AttributeType'];
 export type Auth = components['schemas']['Auth'];
+export type AuthCodeDelivery = components['schemas']['AuthCodeDelivery'];
 export type BatchSortField = components['schemas']['BatchSortField'];
 export type BatchStatus = components['schemas']['BatchStatus'];
 export type BillingMetadata = components['schemas']['BillingMetadata'];
@@ -171,6 +173,7 @@ export type DnssecRecordType = components['schemas']['DnssecRecordType'];
 export type DnssecRegistryPublishOutcome = components['schemas']['DnssecRegistryPublishOutcome'];
 export type DnssecStatus = components['schemas']['DnssecStatus'];
 export type DomainAttributeKey = components['schemas']['DomainAttributeKey'];
+export type DomainAuthCode = components['schemas']['DomainAuthCodeResponse'];
 export type DomainAvailability = components['schemas']['DomainAvailability'];
 export type DomainAvailabilityError = components['schemas']['DomainAvailabilityError'];
 export type DomainAvailabilityMeta = components['schemas']['DomainAvailabilityMeta'];

package/src/openapi.yaml

@@ -13,6 +13,14 @@ components:
         - rfc3339
         type: string
   schemas:
+    AccountTypeFilterMode:
+      description: How an `account_type` filter applies; no `match_all`, since a domain
+        has exactly one account type.
+      enum:
+      - match_any
+      - match_none
+      title: AccountTypeFilterMode
+      type: string
     AggregationResult:
       properties:
         field:
@@ -356,6 +364,12 @@ components:
           title: Client Id
       title: Auth
       type: object
+    AuthCodeDelivery:
+      enum:
+      - response
+      - registrant_email
+      title: AuthCodeDelivery
+      type: string
     BatchSortField:
       enum:
       - created_on
@@ -6616,6 +6630,37 @@ components:
         - operationId
         title: request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post
         type: object
+      - properties:
+          data:
+            anyOf:
+            - $ref: '#/components/schemas/DomainAuthCodeResponse'
+            - type: string
+          headers:
+            additionalProperties:
+              type: string
+            description: Selected response headers
+            title: Headers
+            type: object
+          httpStatus:
+            anyOf:
+            - type: integer
+            - type: 'null'
+            description: HTTP status returned by the underlying API
+            title: Httpstatus
+          operationId:
+            const: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+          status:
+            const: ok
+          truncated:
+            default: false
+            description: True when the gateway capped an oversized payload
+            title: Truncated
+            type: boolean
+        required:
+        - status
+        - operationId
+        title: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+        type: object
       - properties:
           data:
             anyOf:
@@ -11387,6 +11432,45 @@ components:
       - registry_reseller_id
       title: DomainAttributeKey
       type: string
+    DomainAuthCodeResponse:
+      properties:
+        auth_code:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: The auth code, when `delivery` is `response`. Hidden when the
+            caller cannot view the domain's auth codes
+          title: Auth Code
+        auth_code_expires_on:
+          anyOf:
+          - format: date-time
+            type: string
+          - type: 'null'
+          description: When the auth code expires, if the registry limits its validity
+          title: Auth Code Expires On
+        delivery:
+          $ref: '#/components/schemas/AuthCodeDelivery'
+          description: 'Where the auth code ends up: `response` returns it in `auth_code`,
+            `registrant_email` means the registry emails it to the registrant and
+            it never reaches us'
+        name:
+          description: The domain name the auth code belongs to
+          title: Name
+          type: string
+        recipients:
+          anyOf:
+          - items:
+              type: string
+            type: array
+          - type: 'null'
+          description: The addresses the registry sent the auth code to, when it reports
+            them
+          title: Recipients
+      required:
+      - name
+      - delivery
+      title: DomainAuthCodeResponse
+      type: object
     DomainAvailability:
       properties:
         domain:
@@ -24882,7 +24966,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-10-08-191153
+  version: 2026-10-09-190403
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -33523,10 +33607,10 @@ paths:
       - description: 'Filter domains by the type of the registry account they are
           held on: `ras` for domains on a registrar-abstraction (RAS) account synced
           from a connected external registrar, including those whose credential has
-          since been deleted (their `connected_account` is null); `ams` for domains
-          managed on a customer''s own registry accreditation; `default` for all others,
-          manually managed domains included (their accounts are typed `default`).
-          Can be specified multiple times (union of all provided values).'
+          since been deleted; `ams` for domains managed on a customer''s own registry
+          accreditation; `default` for all others, manually managed domains included
+          (their accounts are typed `default`). Can be specified multiple times (union
+          of all provided values).'
         in: query
         name: account_type
         required: false
@@ -33539,29 +33623,26 @@ paths:
           description: 'Filter domains by the type of the registry account they are
             held on: `ras` for domains on a registrar-abstraction (RAS) account synced
             from a connected external registrar, including those whose credential
-            has since been deleted (their `connected_account` is null); `ams` for
-            domains managed on a customer''s own registry accreditation; `default`
-            for all others, manually managed domains included (their accounts are
-            typed `default`). Can be specified multiple times (union of all provided
-            values).'
+            has since been deleted; `ams` for domains managed on a customer''s own
+            registry accreditation; `default` for all others, manually managed domains
+            included (their accounts are typed `default`). Can be specified multiple
+            times (union of all provided values).'
           title: Account Type
       - description: 'How to apply `account_type`: `match_any` keeps the domains on
           any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none`
-          lists every domain not on a RAS account, and listing every type returns
-          nothing). Has no effect without `account_type`. `match_all` is refused:
-          a domain has exactly one account type.'
+          keeps every domain not on a RAS account, and naming every type keeps none).
+          Has no effect without `account_type`.'
         in: query
         name: account_type_mode
         required: false
         schema:
-          $ref: '#/components/schemas/TagFilterMode'
+          $ref: '#/components/schemas/AccountTypeFilterMode'
           default: match_any
           description: 'How to apply `account_type`: `match_any` keeps the domains
             on any of the listed types, `match_none` the domains on none of them (so
-            `account_type=ras&account_type_mode=match_none` lists every domain not
-            on a RAS account, and listing every type returns nothing). Has no effect
-            without `account_type`. `match_all` is refused: a domain has exactly one
-            account type.'
+            `account_type=ras&account_type_mode=match_none` keeps every domain not
+            on a RAS account, and naming every type keeps none). Has no effect without
+            `account_type`.'
       - description: Extra data to include in each result. `tags` populates the `tags`
           (user tags) and `status_tags` fields, which are otherwise null; filtering
           by `tag_ids` or `status_tags` alone does not populate them. `connected_account`
@@ -34015,9 +34096,54 @@ paths:
         by status, status tag, TLD,
 
         registry account type and expiration timeframe. Only `by_organization` includes
-        sub-organizations.'
+        sub-organizations.
+
+        With `account_type`, every count covers only the domains that filter keeps,
+        so a sub-organization
+
+        whose domains all fall outside it is left out of `by_organization`, as one
+        without domains always is.'
       operationId: get_domain_summary_v1_domains_summary_get
       parameters:
+      - description: 'Filter domains by the type of the registry account they are
+          held on: `ras` for domains on a registrar-abstraction (RAS) account synced
+          from a connected external registrar, including those whose credential has
+          since been deleted; `ams` for domains managed on a customer''s own registry
+          accreditation; `default` for all others, manually managed domains included
+          (their accounts are typed `default`). Can be specified multiple times (union
+          of all provided values).'
+        in: query
+        name: account_type
+        required: false
+        schema:
+          anyOf:
+          - items:
+              $ref: '#/components/schemas/ConnectedAccountType'
+            type: array
+          - type: 'null'
+          description: 'Filter domains by the type of the registry account they are
+            held on: `ras` for domains on a registrar-abstraction (RAS) account synced
+            from a connected external registrar, including those whose credential
+            has since been deleted; `ams` for domains managed on a customer''s own
+            registry accreditation; `default` for all others, manually managed domains
+            included (their accounts are typed `default`). Can be specified multiple
+            times (union of all provided values).'
+          title: Account Type
+      - description: 'How to apply `account_type`: `match_any` keeps the domains on
+          any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none`
+          keeps every domain not on a RAS account, and naming every type keeps none).
+          Has no effect without `account_type`.'
+        in: query
+        name: account_type_mode
+        required: false
+        schema:
+          $ref: '#/components/schemas/AccountTypeFilterMode'
+          default: match_any
+          description: 'How to apply `account_type`: `match_any` keeps the domains
+            on any of the listed types, `match_none` the domains on none of them (so
+            `account_type=ras&account_type_mode=match_none` keeps every domain not
+            on a RAS account, and naming every type keeps none). Has no effect without
+            `account_type`.'
       - $ref: '#/components/parameters/DatetimeFormatHeader'
       responses:
         '200':
@@ -34101,6 +34227,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/be/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_be__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34168,11 +34297,13 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/cymru/{domain_reference}/auth_code/request:
     post:
-      description: Nominet expires a Transfer Authorisation Code after 14 days or
-        on use in a transfer, and enforces complexity requirements on it. This endpoint
-        mints a compliant code, sets it through a `domain:update` and returns it,
-        invalidating any previous one. It is the only way to change a `.cymru` auth
-        code.
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. Nominet expires a Transfer Authorisation Code after
+        14 days or on use in a transfer, and enforces complexity requirements on it.
+        This endpoint mints a compliant code, sets it through a `domain:update` and
+        returns it, invalidating any previous one. It is the only way to change a
+        `.cymru` auth code.'
       operationId: request_auth_code_v1_domains_tld_specific_cymru__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34240,6 +34371,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/cz/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_cz__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34366,6 +34500,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/dk/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_dk__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34433,6 +34570,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/eu/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_eu__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34500,6 +34640,9 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/lt/{domain_reference}/auth_code/request:
     post:
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD.'
       operationId: request_auth_code_v1_domains_tld_specific_lt__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34828,10 +34971,12 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/nu/{domain_reference}/auth_code/request:
     post:
-      description: '`.nu` auth codes are owned by the registry: registrars can only
-        send the literal `auto`, and the generated code is returned in the `iis:updData`
-        extension of a `domain:update`. This endpoint runs that update and stores
-        the fresh code, invalidating any previous one.'
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. `.nu` auth codes are owned by the registry: registrars
+        can only send the literal `auto`, and the generated code is returned in the
+        `iis:updData` extension of a `domain:update`. This endpoint runs that update
+        and stores the fresh code, invalidating any previous one.'
       operationId: request_auth_code_v1_domains_tld_specific_nu__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34899,10 +35044,12 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/se/{domain_reference}/auth_code/request:
     post:
-      description: '`.se` auth codes are owned by the registry: registrars can only
-        send the literal `auto`, and the generated code is returned in the `iis:updData`
-        extension of a `domain:update`. This endpoint runs that update and stores
-        the fresh code, invalidating any previous one.'
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. `.se` auth codes are owned by the registry: registrars
+        can only send the literal `auto`, and the generated code is returned in the
+        `iis:updData` extension of a `domain:update`. This endpoint runs that update
+        and stores the fresh code, invalidating any previous one.'
       operationId: request_auth_code_v1_domains_tld_specific_se__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -34970,11 +35117,13 @@ paths:
       - domains:manage
   /v1/domains/tld-specific/wales/{domain_reference}/auth_code/request:
     post:
-      description: Nominet expires a Transfer Authorisation Code after 14 days or
-        on use in a transfer, and enforces complexity requirements on it. This endpoint
-        mints a compliant code, sets it through a `domain:update` and returns it,
-        invalidating any previous one. It is the only way to change a `.wales` auth
-        code.
+      deprecated: true
+      description: 'Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`,
+        which handles every TLD. Nominet expires a Transfer Authorisation Code after
+        14 days or on use in a transfer, and enforces complexity requirements on it.
+        This endpoint mints a compliant code, sets it through a `domain:update` and
+        returns it, invalidating any previous one. It is the only way to change a
+        `.wales` auth code.'
       operationId: request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post
       parameters:
       - in: path
@@ -35407,6 +35556,102 @@ paths:
       - domain
       x-required-permissions:
       - domains:manage
+  /v1/domains/{domain_reference}/auth-code:
+    post:
+      description: Gets the domain a fresh auth code, whatever the registry's model.
+        Where the registrar sets the code, one is generated, set at the registry and
+        returned, invalidating the previous one. Where the registry generates it,
+        it is requested there and returned, or, for registries that only send it to
+        the registrant (`.be`, `.cz`), `delivery` is `registrant_email` and no code
+        is returned. TLDs without auth codes answer 422. `auth_code` is hidden when
+        the caller cannot view the domain's auth codes.
+      operationId: request_domain_auth_code_v1_domains__domain_reference__auth_code_post
+      parameters:
+      - in: path
+        name: domain_reference
+        required: true
+        schema:
+          anyOf:
+          - examples:
+            - domain_01h45ytscbebyvny4gc8cr8ma2
+            format: typeid
+            pattern: ^domain_[0-7][0-9a-hjkmnpq-tv-z]{25}$
+            type: string
+            x-typeid-prefix: domain
+          - type: string
+          title: Domain Reference
+      - $ref: '#/components/parameters/DatetimeFormatHeader'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DomainAuthCodeResponse'
+          description: Successful Response
+        '400':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_TRANSFER
+                detail: There was an error transferring the domain
+                domain_name: Additional error context.
+                reason: An unspecified error occurred
+                status: 400
+                title: Domain Transfer Error
+                type: domain-transfer
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Bad Request
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_NOT_FOUND
+                detail: Domain not found
+                domain_name: Additional error context.
+                status: 404
+                title: Domain Management Error
+                type: domain-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
+        '422':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DOMAIN_AUTH_CODE_NOT_SUPPORTED
+                detail: Auth codes are not used
+                domain_name: example.lu
+                status: 422
+                title: Domain Management Error
+                tld: lu
+                type: domain-auth-code-not-supported
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unprocessable Content
+        '502':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTH_CODE
+                detail: The registry did not return an auth code
+                domain_name: example.eu
+                reason: No auth code returned
+                status: 502
+                title: Domain Management Error
+                type: domain-auth-code-unavailable
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Bad Gateway
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Request a fresh auth code
+      tags:
+      - domain
+      - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/dnssec:
     delete:
       description: Removes all DNSSEC data for a domain

package/src/schema.d.ts

@@ -1213,6 +1213,8 @@ export interface paths {
          * Get domain summary
          * @description Retrieves a summary of your organization's domains, with counts by status, status tag, TLD,
          *     registry account type and expiration timeframe. Only `by_organization` includes sub-organizations.
+         *     With `account_type`, every count covers only the domains that filter keeps, so a sub-organization
+         *     whose domains all fall outside it is left out of `by_organization`, as one without domains always is.
          */
         get: operations["get_domain_summary_v1_domains_summary_get"];
         put?: never;
@@ -1249,7 +1251,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from DNS Belgium (registry) */
+        /**
+         * Requests your auth code directly from DNS Belgium (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_be__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1268,7 +1274,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Nominet (.cymru)
-         * @description Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.cymru` auth code.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.cymru` auth code.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_cymru__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1286,7 +1293,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from CZ.NIC (registry) */
+        /**
+         * Requests your auth code directly from CZ.NIC (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_cz__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1320,7 +1331,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from Punktum dk (registry) */
+        /**
+         * Requests your auth code directly from Punktum dk (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_dk__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1337,7 +1352,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from EURid (registry) */
+        /**
+         * Requests your auth code directly from EURid (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_eu__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1354,7 +1373,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Requests your auth code directly from DOMREG (registry) */
+        /**
+         * Requests your auth code directly from DOMREG (registry)
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD.
+         */
         post: operations["request_auth_code_v1_domains_tld_specific_lt__domain_reference__auth_code_request_post"];
         delete?: never;
         options?: never;
@@ -1431,7 +1454,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Internetstiftelsen (.nu)
-         * @description `.nu` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. `.nu` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_nu__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1451,7 +1475,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Internetstiftelsen (.se)
-         * @description `.se` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. `.se` auth codes are owned by the registry: registrars can only send the literal `auto`, and the generated code is returned in the `iis:updData` extension of a `domain:update`. This endpoint runs that update and stores the fresh code, invalidating any previous one.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_se__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1471,7 +1496,8 @@ export interface paths {
         put?: never;
         /**
          * Generates a fresh auth code at Nominet (.wales)
-         * @description Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.wales` auth code.
+         * @deprecated
+         * @description Deprecated: use `POST /v1/domains/{domain_reference}/auth-code`, which handles every TLD. Nominet expires a Transfer Authorisation Code after 14 days or on use in a transfer, and enforces complexity requirements on it. This endpoint mints a compliant code, sets it through a `domain:update` and returns it, invalidating any previous one. It is the only way to change a `.wales` auth code.
          */
         post: operations["request_auth_code_v1_domains_tld_specific_wales__domain_reference__auth_code_request_post"];
         delete?: never;
@@ -1537,6 +1563,26 @@ export interface paths {
         patch: operations["update_domain_v1_domains__domain_reference__patch"];
         trace?: never;
     };
+    "/v1/domains/{domain_reference}/auth-code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request a fresh auth code
+         * @description Gets the domain a fresh auth code, whatever the registry's model. Where the registrar sets the code, one is generated, set at the registry and returned, invalidating the previous one. Where the registry generates it, it is requested there and returned, or, for registries that only send it to the registrant (`.be`, `.cz`), `delivery` is `registrant_email` and no code is returned. TLDs without auth codes answer 422. `auth_code` is hidden when the caller cannot view the domain's auth codes.
+         */
+        post: operations["request_domain_auth_code_v1_domains__domain_reference__auth_code_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/domains/{domain_reference}/dnssec": {
         parameters: {
             query?: never;
@@ -3249,6 +3295,12 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
+        /**
+         * AccountTypeFilterMode
+         * @description How an `account_type` filter applies; no `match_all`, since a domain has exactly one account type.
+         * @enum {string}
+         */
+        AccountTypeFilterMode: "match_any" | "match_none";
         /** AggregationResult */
         AggregationResult: {
             /** Field */
@@ -3459,6 +3511,11 @@ export interface components {
             /** Client Id */
             client_id?: string | null;
         };
+        /**
+         * AuthCodeDelivery
+         * @enum {string}
+         */
+        AuthCodeDelivery: "response" | "registrant_email";
         /**
          * BatchSortField
          * @enum {string}
@@ -8154,6 +8211,30 @@ export interface components {
              * @default false
              */
             truncated: boolean;
+        } | {
+            data?: components["schemas"]["DomainAuthCodeResponse"] | string;
+            /**
+             * Headers
+             * @description Selected response headers
+             */
+            headers?: {
+                [key: string]: string;
+            };
+            /**
+             * Httpstatus
+             * @description HTTP status returned by the underlying API
+             */
+            httpStatus?: number | null;
+            /** @constant */
+            operationId: "request_domain_auth_code_v1_domains__domain_reference__auth_code_post";
+            /** @constant */
+            status: "ok";
+            /**
+             * Truncated
+             * @description True when the gateway capped an oversized payload
+             * @default false
+             */
+            truncated: boolean;
         } | {
             data?: string;
             /**
@@ -11397,6 +11478,31 @@ export interface components {
          * @enum {string}
          */
         DomainAttributeKey: "auto_renew_period" | "music_registrant_attestation" | "nic_it_compliance_confirmation" | "travel_industry_acknowledgement" | "verification_required" | "de_general_request_contact" | "de_abuse_contact" | "nor_id_applicant_version" | "nor_id_applicant_accept_name" | "nor_id_applicant_accept_date" | "nor_id_declaration" | "nor_id_declaration_token" | "punktum_dk_terms_acceptance" | "punktum_dk_tracking_no" | "internet_ee_registrant_agreement" | "promotion" | "promotion_eligibility" | "domain_contact_attributes" | "registry_reseller_id";
+        /** DomainAuthCodeResponse */
+        DomainAuthCodeResponse: {
+            /**
+             * Auth Code
+             * @description The auth code, when `delivery` is `response`. Hidden when the caller cannot view the domain's auth codes
+             */
+            auth_code?: string | null;
+            /**
+             * Auth Code Expires On
+             * @description When the auth code expires, if the registry limits its validity
+             */
+            auth_code_expires_on?: Date | null;
+            /** @description Where the auth code ends up: `response` returns it in `auth_code`, `registrant_email` means the registry emails it to the registrant and it never reaches us */
+            delivery: components["schemas"]["AuthCodeDelivery"];
+            /**
+             * Name
+             * @description The domain name the auth code belongs to
+             */
+            name: string;
+            /**
+             * Recipients
+             * @description The addresses the registry sent the auth code to, when it reports them
+             */
+            recipients?: string[] | null;
+        };
         /** DomainAvailability */
         DomainAvailability: {
             /** Domain */
@@ -26717,10 +26823,10 @@ export interface operations {
                 registrar_credential_id?: TypeId<"registrar_credential">[] | null;
                 /** @description Filter domains held at an external registrar by that registrar. Can be specified multiple times (union of all provided values); combined with `registrar_credential_id`, both must match. Matches exactly the domains whose `connected_account` field carries the registrar, so domains OpusDNS sponsors never match. */
                 registrar?: components["schemas"]["Registrar"][] | null;
-                /** @description Filter domains by the type of the registry account they are held on: `ras` for domains on a registrar-abstraction (RAS) account synced from a connected external registrar, including those whose credential has since been deleted (their `connected_account` is null); `ams` for domains managed on a customer's own registry accreditation; `default` for all others, manually managed domains included (their accounts are typed `default`). Can be specified multiple times (union of all provided values). */
+                /** @description Filter domains by the type of the registry account they are held on: `ras` for domains on a registrar-abstraction (RAS) account synced from a connected external registrar, including those whose credential has since been deleted; `ams` for domains managed on a customer's own registry accreditation; `default` for all others, manually managed domains included (their accounts are typed `default`). Can be specified multiple times (union of all provided values). */
                 account_type?: components["schemas"]["ConnectedAccountType"][] | null;
-                /** @description How to apply `account_type`: `match_any` keeps the domains on any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none` lists every domain not on a RAS account, and listing every type returns nothing). Has no effect without `account_type`. `match_all` is refused: a domain has exactly one account type. */
-                account_type_mode?: components["schemas"]["TagFilterMode"];
+                /** @description How to apply `account_type`: `match_any` keeps the domains on any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none` keeps every domain not on a RAS account, and naming every type keeps none). Has no effect without `account_type`. */
+                account_type_mode?: components["schemas"]["AccountTypeFilterMode"];
                 /** @description Extra data to include in each result. `tags` populates the `tags` (user tags) and `status_tags` fields, which are otherwise null; filtering by `tag_ids` or `status_tags` alone does not populate them. `connected_account` populates the `connected_account` field for domains held at an external registrar. */
                 include?: components["schemas"]["DomainListIncludeField"][] | null;
             };
@@ -27013,7 +27119,12 @@ export interface operations {
     };
     get_domain_summary_v1_domains_summary_get: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Filter domains by the type of the registry account they are held on: `ras` for domains on a registrar-abstraction (RAS) account synced from a connected external registrar, including those whose credential has since been deleted; `ams` for domains managed on a customer's own registry accreditation; `default` for all others, manually managed domains included (their accounts are typed `default`). Can be specified multiple times (union of all provided values). */
+                account_type?: components["schemas"]["ConnectedAccountType"][] | null;
+                /** @description How to apply `account_type`: `match_any` keeps the domains on any of the listed types, `match_none` the domains on none of them (so `account_type=ras&account_type_mode=match_none` keeps every domain not on a RAS account, and naming every type keeps none). Has no effect without `account_type`. */
+                account_type_mode?: components["schemas"]["AccountTypeFilterMode"];
+            };
             header?: {
                 /**
                  * @description Accepted for backwards compatibility; has no effect. Response datetimes are always normalized to UTC and serialized as RFC 3339 with a `Z` suffix, whether or not this header is sent.
@@ -28373,6 +28484,105 @@ export interface operations {
             };
         };
     };
+    request_domain_auth_code_v1_domains__domain_reference__auth_code_post: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Accepted for backwards compatibility; has no effect. Response datetimes are always normalized to UTC and serialized as RFC 3339 with a `Z` suffix, whether or not this header is sent.
+                 * @example rfc3339
+                 */
+                "X-Datetime-Format"?: components["parameters"]["DatetimeFormatHeader"];
+            };
+            path: {
+                domain_reference: TypeId<"domain"> | string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DomainAuthCodeResponse"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_TRANSFER",
+                     *       "detail": "There was an error transferring the domain",
+                     *       "domain_name": "Additional error context.",
+                     *       "reason": "An unspecified error occurred",
+                     *       "status": 400,
+                     *       "title": "Domain Transfer Error",
+                     *       "type": "domain-transfer"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_NOT_FOUND",
+                     *       "detail": "Domain not found",
+                     *       "domain_name": "Additional error context.",
+                     *       "status": 404,
+                     *       "title": "Domain Management Error",
+                     *       "type": "domain-not-found"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Unprocessable Content */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_DOMAIN_AUTH_CODE_NOT_SUPPORTED",
+                     *       "detail": "Auth codes are not used",
+                     *       "domain_name": "example.lu",
+                     *       "status": 422,
+                     *       "title": "Domain Management Error",
+                     *       "tld": "lu",
+                     *       "type": "domain-auth-code-not-supported"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Bad Gateway */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /** @example {
+                     *       "code": "ERROR_AUTH_CODE",
+                     *       "detail": "The registry did not return an auth code",
+                     *       "domain_name": "example.eu",
+                     *       "reason": "No auth code returned",
+                     *       "status": 502,
+                     *       "title": "Domain Management Error",
+                     *       "type": "domain-auth-code-unavailable"
+                     *     } */
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+        };
+    };
     get_dnssec_v1_domains__domain_reference__dnssec_get: {
         parameters: {
             query?: never;