@opusdns/api 1.4.0 → 1.6.0

package/src/openapi.yaml

@@ -9090,90 +9090,6 @@ components:
       - d
       title: PeriodUnit
       type: string
-    Permission:
-      enum:
-      - bulk_create
-      - bulk_delete
-      - bulk_renew_expire
-      - bulk_transfer_trade
-      - bulk_update
-      - corporate_plan
-      - create
-      - create_vanity_ns
-      - delete
-      - delete_api_keys
-      - delete_contacts
-      - delete_dns_zones
-      - delete_domains
-      - delete_domain_forwards
-      - delete_email_forwards
-      - delete_events
-      - delete_hosts
-      - delete_jobs
-      - delete_parking
-      - delete_registrar_credentials
-      - delete_tags
-      - delete_users
-      - enterprise_plan
-      - has_accepted_tos
-      - manage_api_keys
-      - manage_billing
-      - manage_chats
-      - manage_cms_content
-      - manage_contacts
-      - manage_dns_zones
-      - manage_domains
-      - manage_domain_forwards
-      - manage_email_forwards
-      - manage_events
-      - manage_hosts
-      - manage_jobs
-      - manage_opusdns_api_keys
-      - manage_parking
-      - manage_products
-      - manage_registrar_credentials
-      - manage_reseller
-      - manage_sub_zones
-      - manage_tags
-      - manage_users
-      - manage_user_relations
-      - manage_vanity_ns
-      - plan_manager
-      - premium_plan
-      - renew_expire
-      - starter_plan
-      - transfer_trade
-      - update
-      - update_domain_forwards
-      - verify
-      - view
-      - view_api_keys
-      - view_audit_logs
-      - view_billing
-      - view_contacts
-      - view_dns_zones
-      - view_domains
-      - view_domain_forwards
-      - view_email_forwards
-      - view_events
-      - view_hosts
-      - view_jobs
-      - view_parking
-      - view_registrar_credentials
-      - view_tags
-      - view_users
-      - view_vanity_ns
-      title: Permission
-      type: string
-    PermissionSet:
-      properties:
-        permissions:
-          items:
-            $ref: '#/components/schemas/Permission'
-          title: Permissions
-          type: array
-      title: PermissionSet
-      type: object
     PlatformStatsBucket:
       properties:
         key:
@@ -9424,6 +9340,21 @@ components:
       - client_secret
       title: PublicAuthRequestForm
       type: object
+    PublicPermission:
+      examples:
+      - domains:read
+      - domains:manage
+      - domains:delete
+      type: string
+    PublicPermissionSet:
+      properties:
+        permissions:
+          items:
+            $ref: '#/components/schemas/PublicPermission'
+          title: Permissions
+          type: array
+      title: PublicPermissionSet
+      type: object
     PublicReportListRes:
       properties:
         pagination:
@@ -9496,6 +9427,50 @@ components:
       - updated_on
       title: PublicReportRes
       type: object
+    PublicResource:
+      enum:
+      - domains
+      - contacts
+      - dns
+      - hosts
+      - email_forwards
+      - domain_forwards
+      - parking
+      - events
+      - jobs
+      - billing
+      - users
+      - api_keys
+      - registrar_credentials
+      - tags
+      - audit_logs
+      - vanity_ns
+      title: PublicResource
+      type: string
+    PublicRole:
+      enum:
+      - admin
+      - viewer
+      - domain_manager
+      - dns_manager
+      - billing_manager
+      title: PublicRole
+      type: string
+    PublicRoleAssignment:
+      properties:
+        role:
+          anyOf:
+          - $ref: '#/components/schemas/PublicRole'
+          - type: 'null'
+      title: PublicRoleAssignment
+      type: object
+    PublicScope:
+      enum:
+      - read
+      - manage
+      - delete
+      title: PublicScope
+      type: string
     RdapBase:
       properties:
         rdap_server:
@@ -9617,71 +9592,6 @@ components:
       - supported
       title: RegistryLockBase
       type: object
-    Relation:
-      enum:
-      - accepted_tos
-      - root_admin
-      - owner
-      - parent
-      - admin
-      - member
-      - client_api_key
-      - opusdns_internal_api_key
-      - reseller_manager
-      - chat_manager
-      - domain_view
-      - domain_manage
-      - domain_delete
-      - contact_view
-      - contact_manage
-      - contact_delete
-      - dns_zone_view
-      - dns_zone_manage
-      - dns_zone_delete
-      - host_view
-      - host_manage
-      - host_delete
-      - email_forward_view
-      - email_forward_manage
-      - email_forward_delete
-      - domain_forward_view
-      - domain_forward_manage
-      - domain_forward_delete
-      - parking_view
-      - parking_manage
-      - parking_delete
-      - events_view
-      - events_manage
-      - events_delete
-      - jobs_view
-      - jobs_manage
-      - jobs_delete
-      - tag_view
-      - tag_manage
-      - tag_delete
-      - registrar_credential_view
-      - registrar_credential_manage
-      - registrar_credential_delete
-      - user_view
-      - user_manage
-      - user_delete
-      - api_key_view
-      - api_key_manage
-      - api_key_delete
-      - billing_view
-      - billing_manage
-      - audit_log_view
-      title: Relation
-      type: string
-    RelationSet:
-      properties:
-        relations:
-          items:
-            $ref: '#/components/schemas/Relation'
-          title: Relations
-          type: array
-      title: RelationSet
-      type: object
     RenewalMode:
       enum:
       - renew
@@ -9872,24 +9782,6 @@ components:
       - desc
       title: SortOrder
       type: string
-    SpiceDbRelationshipUpdate:
-      properties:
-        add:
-          anyOf:
-          - items:
-              $ref: '#/components/schemas/Relation'
-            type: array
-          - type: 'null'
-          title: Add
-        remove:
-          anyOf:
-          - items:
-              $ref: '#/components/schemas/Relation'
-            type: array
-          - type: 'null'
-          title: Remove
-      title: SpiceDbRelationshipUpdate
-      type: object
     StatusChanges:
       properties:
         add:
@@ -11213,7 +11105,7 @@ components:
           title: Username
       title: UserUpdate
       type: object
-    UserWithRelationPermissions:
+    UserWithPermissions:
       properties:
         created_on:
           description: The date/time the entry was created on
@@ -11262,7 +11154,7 @@ components:
         permissions:
           anyOf:
           - items:
-              $ref: '#/components/schemas/Permission'
+              $ref: '#/components/schemas/PublicPermission'
             type: array
           - type: 'null'
           title: Permissions
@@ -11275,13 +11167,6 @@ components:
           examples:
           - '+1.2125552368'
           title: Phone
-        relations:
-          anyOf:
-          - items:
-              $ref: '#/components/schemas/Relation'
-            type: array
-          - type: 'null'
-          title: Relations
         status:
           $ref: '#/components/schemas/UserStatus'
           readOnly: true
@@ -11326,7 +11211,7 @@ components:
       - email
       - locale
       - status
-      title: UserWithRelationPermissions
+      title: UserWithPermissions
       type: object
     ValidationError:
       properties:
@@ -11652,7 +11537,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-06-08-154726
+  version: 2026-06-10-075045
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -12932,6 +12817,8 @@ paths:
       summary: Retrieve email forward logs by alias
       tags:
       - archive
+      x-required-permissions:
+      - email_forwards:read
   /v1/archive/email-forward-logs/{email_forward_id}:
     get:
       description: Retrieves a paginated list of email forward logs for a specific
@@ -13023,6 +12910,8 @@ paths:
       summary: Retrieve email forward logs
       tags:
       - archive
+      x-required-permissions:
+      - email_forwards:read
   /v1/archive/object-logs:
     get:
       description: Retrieve all paginated audit logs with optional filtering and sorting
@@ -13823,6 +13712,8 @@ paths:
       summary: List all contacts
       tags:
       - contact
+      x-required-permissions:
+      - contacts:read
     post:
       description: Create a new contact object to use for domain registration
       operationId: create_contact_v1_contacts_post
@@ -13851,6 +13742,8 @@ paths:
       summary: Create a contact
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/contacts/attribute-sets:
     get:
       operationId: list_attribute_sets_v1_contacts_attribute_sets_get
@@ -13919,6 +13812,8 @@ paths:
       summary: List contact attribute sets
       tags:
       - contact
+      x-required-permissions:
+      - contacts:read
     post:
       operationId: create_attribute_set_v1_contacts_attribute_sets_post
       requestBody:
@@ -13960,6 +13855,8 @@ paths:
       summary: Create a contact attribute set
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/contacts/attribute-sets/{contact_attribute_set_id}:
     delete:
       operationId: delete_attribute_set_v1_contacts_attribute_sets__contact_attribute_set_id__delete
@@ -14003,6 +13900,8 @@ paths:
       summary: Delete a contact attribute set
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
     get:
       operationId: get_attribute_set_v1_contacts_attribute_sets__contact_attribute_set_id__get
       parameters:
@@ -14049,6 +13948,8 @@ paths:
       summary: Retrieve a contact attribute set
       tags:
       - contact
+      x-required-permissions:
+      - contacts:read
     patch:
       operationId: update_attribute_set_v1_contacts_attribute_sets__contact_attribute_set_id__patch
       parameters:
@@ -14115,6 +14016,8 @@ paths:
       summary: Update a contact attribute set
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/contacts/verification:
     get:
       operationId: get_verification_by_token_v1_contacts_verification_get
@@ -14309,6 +14212,8 @@ paths:
       summary: Delete a contact
       tags:
       - contact
+      x-required-permissions:
+      - contacts:delete
     get:
       operationId: get_contact_v1_contacts__contact_id__get
       parameters:
@@ -14365,6 +14270,8 @@ paths:
       summary: Retrieve a contact
       tags:
       - contact
+      x-required-permissions:
+      - contacts:read
   /v1/contacts/{contact_id}/link/{contact_attribute_set_id}:
     patch:
       operationId: create_attribute_link_v1_contacts__contact_id__link__contact_attribute_set_id__patch
@@ -14448,6 +14355,8 @@ paths:
       summary: Link a contact to a contact attribute set
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/contacts/{contact_id}/verification:
     delete:
       operationId: cancel_verification_v1_contacts__contact_id__verification_delete
@@ -14503,6 +14412,8 @@ paths:
       summary: Delete contact verification
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
     get:
       operationId: get_verification_status_v1_contacts__contact_id__verification_get
       parameters:
@@ -14561,6 +14472,8 @@ paths:
       summary: Retrieve contact verification by contact ID
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
     post:
       operationId: start_contact_verification_v1_contacts__contact_id__verification_post
       parameters:
@@ -14640,6 +14553,8 @@ paths:
       summary: Start contact verification
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
     put:
       operationId: update_verification_v1_contacts__contact_id__verification_put
       parameters:
@@ -14728,6 +14643,8 @@ paths:
       summary: Complete contact verification by contact ID
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/contacts/{contact_id}/verifications:
     get:
       description: Retrieve the current verification state for a contact from the
@@ -14801,6 +14718,8 @@ paths:
       summary: Get contact verification status
       tags:
       - contact
+      x-required-permissions:
+      - contacts:read
   /v1/contacts/{contact_id}/verifications/attest:
     post:
       description: Submit one or more contact-verification attestations. Returns the
@@ -14895,6 +14814,8 @@ paths:
       summary: Attest a contact verification
       tags:
       - contact
+      x-required-permissions:
+      - contacts:manage
   /v1/dns:
     get:
       operationId: list_zones_v1_dns_get
@@ -15092,6 +15013,8 @@ paths:
       summary: List Zones
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
     post:
       operationId: create_zone_v1_dns_post
       requestBody:
@@ -15346,6 +15269,8 @@ paths:
       summary: Create Zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
   /v1/dns/domain-forwards:
     get:
       description: Retrieves a paginated list of domain forwards grouped by DNS zones.
@@ -15465,6 +15390,8 @@ paths:
       summary: List domain forwards by zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/email-forwards:
     get:
       description: Retrieves a paginated list of email forwards grouped by DNS zones.
@@ -15550,6 +15477,8 @@ paths:
       summary: List email forwards by zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/summary:
     get:
       operationId: get_zones_summary_v1_dns_summary_get
@@ -15581,6 +15510,8 @@ paths:
       summary: Get Zones Summary
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/{zone_name}:
     delete:
       operationId: delete_zone_v1_dns__zone_name__delete
@@ -15608,6 +15539,8 @@ paths:
       summary: Delete Zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:delete
     get:
       operationId: get_zone_v1_dns__zone_name__get
       parameters:
@@ -15648,6 +15581,8 @@ paths:
       summary: Get Zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/{zone_name}/dnssec/disable:
     post:
       operationId: disable_dnssec_v1_dns__zone_name__dnssec_disable_post
@@ -15734,6 +15669,8 @@ paths:
       summary: Disable Dnssec
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
   /v1/dns/{zone_name}/dnssec/enable:
     post:
       operationId: enable_dnssec_v1_dns__zone_name__dnssec_enable_post
@@ -15820,6 +15757,8 @@ paths:
       summary: Enable Dnssec
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
   /v1/dns/{zone_name}/domain-forwards:
     get:
       description: Retrieves all domain forwards configured for the specified DNS
@@ -15903,6 +15842,8 @@ paths:
       summary: List domain forwards for a zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/{zone_name}/email-forwards:
     get:
       description: Retrieves all email forwards configured for the specified DNS zone,
@@ -15960,6 +15901,8 @@ paths:
       summary: List email forwards for a zone
       tags:
       - dns
+      x-required-permissions:
+      - dns:read
   /v1/dns/{zone_name}/records:
     patch:
       operationId: patch_zone_records_v1_dns__zone_name__records_patch
@@ -16059,6 +16002,8 @@ paths:
       summary: Patch Zone Records
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
   /v1/dns/{zone_name}/rrsets:
     patch:
       operationId: patch_zone_rrsets_v1_dns__zone_name__rrsets_patch
@@ -16204,6 +16149,8 @@ paths:
       summary: Patch Zone Rrsets
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
     put:
       operationId: update_zone_rrsets_v1_dns__zone_name__rrsets_put
       parameters:
@@ -16336,6 +16283,8 @@ paths:
       summary: Update Zone Rrsets
       tags:
       - dns
+      x-required-permissions:
+      - dns:manage
   /v1/domain-forwards:
     get:
       description: Retrieves a paginated list of domain forwards by hostname for the
@@ -16519,6 +16468,8 @@ paths:
       summary: List domain forwards
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
     patch:
       description: Applies patch operations to update or remove redirects across hostnames
         and protocols. Raises an error if the domain forward or domain forward set
@@ -16581,6 +16532,8 @@ paths:
       summary: Patch domain forward redirects
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
     post:
       description: Creates a new domain forward configuration. Wildcard forwards can
         be created by using *.hostname (e.g., *.example.com).
@@ -16756,6 +16709,8 @@ paths:
       summary: Create a domain forward
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
   /v1/domain-forwards/metrics:
     get:
       description: Retrieves overall metrics for domain forwards including total and
@@ -16874,6 +16829,8 @@ paths:
       summary: Get domain forward metrics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/browser:
     get:
       description: Retrieves visitor traffic broken down by browser type (Chrome,
@@ -17015,6 +16972,8 @@ paths:
       summary: Get browser statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/geo:
     get:
       description: Retrieves visitor traffic broken down by geographic location (country
@@ -17149,6 +17108,8 @@ paths:
       summary: Get geographic statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/platform:
     get:
       description: Retrieves visitor traffic broken down by platform (Windows, Macintosh,
@@ -17288,6 +17249,8 @@ paths:
       summary: Get platform statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/referrer:
     get:
       description: Retrieves visitor referral sources (where traffic came from) with
@@ -17429,6 +17392,8 @@ paths:
       summary: Get referrer statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/status-code:
     get:
       description: Retrieves distribution of HTTP redirect status codes (301, 302,
@@ -17556,6 +17521,8 @@ paths:
       summary: Get HTTP status code statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/time-series:
     get:
       description: Retrieves visit counts bucketed by time intervals (hourly, daily)
@@ -17729,6 +17696,8 @@ paths:
       summary: Get domain forward time series metrics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/user-agent:
     get:
       description: Retrieves visitor traffic broken down by user agent string with
@@ -17862,6 +17831,8 @@ paths:
       summary: Get user agent statistics
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/metrics/visits-by-key:
     get:
       description: Retrieves visit metrics grouped by a specified key (url, fqdn,
@@ -18016,6 +17987,8 @@ paths:
       summary: Get visits grouped by key
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
   /v1/domain-forwards/{hostname}:
     delete:
       description: Deletes the domain forward configuration for the specified hostname
@@ -18080,6 +18053,8 @@ paths:
       summary: Delete a domain forward
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:delete
     get:
       description: Retrieves the domain forward configuration for the specified hostname
       operationId: get_domain_forward_v1_domain_forwards__hostname__get
@@ -18182,6 +18157,8 @@ paths:
       summary: Get a domain forward
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
     post:
       description: Creates a new domain forward set for a specific protocol (HTTP
         or HTTPS). Raises an error if the set already exists.
@@ -18286,6 +18263,8 @@ paths:
       summary: Create domain forward set
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
   /v1/domain-forwards/{hostname}/disable:
     patch:
       description: Disables domain forwarding by removing DNS records. The domain
@@ -18340,6 +18319,8 @@ paths:
       summary: Disable domain forward
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
   /v1/domain-forwards/{hostname}/enable:
     patch:
       description: Enables domain forwarding by creating necessary DNS records
@@ -18393,6 +18374,8 @@ paths:
       summary: Enable domain forward
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
   /v1/domain-forwards/{hostname}/{protocol}:
     delete:
       description: Deletes a domain forward set for a specific protocol (HTTP or HTTPS).
@@ -18463,6 +18446,8 @@ paths:
       summary: Delete domain forward set
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:delete
     get:
       description: Retrieves all redirects for a specific protocol (HTTP or HTTPS)
         for the specified hostname
@@ -18571,6 +18556,8 @@ paths:
       summary: Get domain forward set
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:read
     put:
       description: Updates an existing domain forward set for a specific protocol
         (HTTP or HTTPS). All existing redirects for this protocol are replaced with
@@ -18670,6 +18657,8 @@ paths:
       summary: Update domain forward set
       tags:
       - domain_forward
+      x-required-permissions:
+      - domain_forwards:manage
   /v1/domain-search/suggest:
     get:
       description: Get a list of domain suggestions based on a search query
@@ -19033,6 +19022,8 @@ paths:
       summary: List all domains
       tags:
       - domain
+      x-required-permissions:
+      - domains:read
     post:
       description: 'Registers a new domain.
 
@@ -19150,6 +19141,8 @@ paths:
       summary: Create a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/check:
     get:
       description: 'Performs a real-time check against the authoritative registry
@@ -19237,6 +19230,8 @@ paths:
       summary: Check domain availability and registration metadata
       tags:
       - domain
+      x-required-permissions:
+      - domains:read
   /v1/domains/claims-notices:
     post:
       description: Retrieves the trademark claims notice for a `claims_key` returned
@@ -19296,6 +19291,8 @@ paths:
       summary: Retrieve claims notices from claim keys
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/summary:
     get:
       description: Retrieves a summary of domains including counts by status, TLD,
@@ -19320,6 +19317,8 @@ paths:
       summary: Get domain summary
       tags:
       - domain
+      x-required-permissions:
+      - domains:read
   /v1/domains/tld-specific/at/{domain_reference}/withdraw:
     post:
       operationId: withdraw_domain_v1_domains_tld_specific_at__domain_reference__withdraw_post
@@ -19376,6 +19375,8 @@ paths:
       tags:
       - domain
       - domain_tld_specific
+      x-required-permissions:
+      - domains:manage
   /v1/domains/tld-specific/be/{domain_reference}/auth_code/request:
     post:
       operationId: request_auth_code_v1_domains_tld_specific_be__domain_reference__auth_code_request_post
@@ -19440,6 +19441,8 @@ paths:
       tags:
       - domain
       - domain_tld_specific
+      x-required-permissions:
+      - domains:manage
   /v1/domains/tld-specific/de/{domain_reference}/transit:
     post:
       operationId: transit_domain_v1_domains_tld_specific_de__domain_reference__transit_post
@@ -19496,6 +19499,8 @@ paths:
       tags:
       - domain
       - domain_tld_specific
+      x-required-permissions:
+      - domains:manage
   /v1/domains/tld-specific/eu/{domain_reference}/auth_code/request:
     post:
       operationId: request_auth_code_v1_domains_tld_specific_eu__domain_reference__auth_code_request_post
@@ -19560,6 +19565,8 @@ paths:
       tags:
       - domain
       - domain_tld_specific
+      x-required-permissions:
+      - domains:manage
   /v1/domains/transfer:
     post:
       description: 'Start the transfer process for a domain <br>
@@ -19703,6 +19710,8 @@ paths:
       summary: Transfer a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}:
     delete:
       description: 'Initiates the deletion process for a domain. The domain will be
@@ -19766,6 +19775,8 @@ paths:
       summary: Delete a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:delete
     get:
       description: Retrieves a single active domain by either its name or id
       operationId: get_domain_v1_domains__domain_reference__get
@@ -19827,6 +19838,8 @@ paths:
       summary: Retrieve a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:read
     patch:
       description: 'Updates various attributes of an existing domain. Only the fields
         provided in the request
@@ -19898,6 +19911,8 @@ paths:
       summary: Update a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/dnssec:
     delete:
       description: Removes all DNSSEC data for a domain
@@ -19944,6 +19959,8 @@ paths:
       summary: Delete DNSSEC data
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
     get:
       description: Fetches all DNSSEC records associated with the specified domain.
       operationId: get_dnssec_v1_domains__domain_reference__dnssec_get
@@ -19996,6 +20013,8 @@ paths:
       summary: Retrieve DNSSEC data
       tags:
       - domain
+      x-required-permissions:
+      - domains:read
     put:
       description: Replaces all existing DNSSEC records for the domain with the provided
         records.
@@ -20065,6 +20084,8 @@ paths:
       summary: Update DNSSEC data
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/dnssec/disable:
     post:
       operationId: disable_and_unpublish_dnssec_records_v1_domains__domain_reference__dnssec_disable_post
@@ -20110,6 +20131,8 @@ paths:
       summary: Disable DNSSEC for domains using our nameservers
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/dnssec/enable:
     post:
       operationId: enable_and_publish_dnssec_records_v1_domains__domain_reference__dnssec_enable_post
@@ -20163,6 +20186,8 @@ paths:
       summary: Enable DNSSEC for domains using our nameservers
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/renew:
     post:
       description: 'Extends the registration period of an existing domain. The renewal
@@ -20209,6 +20234,8 @@ paths:
       summary: Renew a domain
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/restore:
     post:
       operationId: restore_domain_v1_domains__domain_reference__restore_post
@@ -20251,6 +20278,8 @@ paths:
       summary: Restore an eligible domain (during redemption period)
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/domains/{domain_reference}/transfer:
     delete:
       description: This will cancel the in-progress domain transfer and delete the
@@ -20312,6 +20341,8 @@ paths:
       summary: Cancel a domain transfer
       tags:
       - domain
+      x-required-permissions:
+      - domains:manage
   /v1/email-forwards:
     get:
       description: Retrieves a paginated list of all email forwards for the organization.
@@ -20405,6 +20436,8 @@ paths:
       summary: List all email forwards
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:read
     post:
       description: 'Creates an email forward configuration with optional aliases.
         Can be created enabled or disabled (default: disabled). Includes created_on
@@ -20546,6 +20579,9 @@ paths:
       summary: Create email forward configuration
       tags:
       - email_forward
+      x-required-permissions:
+      - dns:manage
+      - email_forwards:manage
   /v1/email-forwards/{email_forward_id}:
     delete:
       description: Permanently deletes the email forward configuration including all
@@ -20603,6 +20639,8 @@ paths:
       summary: Delete email forward configuration
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:delete
     get:
       description: Retrieves the email forward configuration for the specified email
         forward including all aliases
@@ -20674,6 +20712,8 @@ paths:
       summary: Get email forward configuration
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:read
   /v1/email-forwards/{email_forward_id}/aliases:
     post:
       description: Creates a new email forward alias for the specified email forward.
@@ -20799,6 +20839,8 @@ paths:
       summary: Create email forward alias
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:manage
   /v1/email-forwards/{email_forward_id}/aliases/{alias_id}:
     delete:
       description: Deletes a specific email forward alias specified by email_forward_alias_id
@@ -20879,6 +20921,8 @@ paths:
       summary: Delete email forward alias
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:manage
     put:
       description: Updates the forward_to address for a specific email forward alias
         specified by email_forward_alias_id
@@ -20968,6 +21012,8 @@ paths:
       summary: Update email forward alias
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:manage
   /v1/email-forwards/{email_forward_id}/disable:
     patch:
       description: Disables email forwarding by removing MX and SPF DNS records and
@@ -21037,6 +21083,8 @@ paths:
       summary: Disable email forwarding
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:manage
   /v1/email-forwards/{email_forward_id}/enable:
     patch:
       description: Enables email forwarding by creating necessary MX and SPF DNS records
@@ -21105,6 +21153,8 @@ paths:
       summary: Enable email forwarding
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:manage
   /v1/email-forwards/{email_forward_id}/metrics:
     get:
       description: Retrieves metrics and statistics for a specific email forward,
@@ -21195,6 +21245,8 @@ paths:
       summary: Retrieve email forward metrics
       tags:
       - email_forward
+      x-required-permissions:
+      - email_forwards:read
   /v1/events:
     get:
       description: Retrieves a paginated list of events for the organization
@@ -21301,6 +21353,8 @@ paths:
       summary: Get pending events
       tags:
       - event
+      x-required-permissions:
+      - events:read
   /v1/events/{event_id}:
     get:
       description: Get an event by its ID
@@ -21361,6 +21415,8 @@ paths:
       summary: Get event
       tags:
       - event
+      x-required-permissions:
+      - events:read
     patch:
       description: Acknowledge an event
       operationId: acknowledge_event_v1_events__event_id__patch
@@ -21416,6 +21472,8 @@ paths:
       summary: Acknowledge event
       tags:
       - event
+      x-required-permissions:
+      - events:manage
   /v1/job/{job_id}:
     delete:
       operationId: delete_job_v1_job__job_id__delete
@@ -21460,6 +21518,8 @@ paths:
       summary: Delete (cancel) a queued job
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
     get:
       operationId: get_job_v1_job__job_id__get
       parameters:
@@ -21507,6 +21567,8 @@ paths:
       summary: Get individual job details
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:read
   /v1/job/{job_id}/pause:
     post:
       operationId: pause_job_v1_job__job_id__pause_post
@@ -21551,6 +21613,8 @@ paths:
       summary: Pause a job
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/job/{job_id}/resume:
     post:
       operationId: resume_job_v1_job__job_id__resume_post
@@ -21599,6 +21663,8 @@ paths:
       summary: Resume a paused job
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/job/{job_id}/retry:
     post:
       operationId: retry_job_v1_job__job_id__retry_post
@@ -21659,6 +21725,8 @@ paths:
       summary: Retry a failed or dead-lettered job
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/jobs:
     get:
       operationId: list_batches_v1_jobs_get
@@ -21725,6 +21793,8 @@ paths:
       summary: List batches for organization
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:read
     post:
       operationId: create_batch_v1_jobs_post
       requestBody:
@@ -22211,6 +22281,12 @@ paths:
       summary: Create a batch of commands for async execution
       tags:
       - jobs
+      x-required-permissions:
+      - contacts:manage
+      - dns:manage
+      - domains:manage
+      - jobs:manage
+      - parking:manage
   /v1/jobs/{batch_id}:
     delete:
       operationId: delete_batch_v1_jobs__batch_id__delete
@@ -22255,6 +22331,8 @@ paths:
       summary: Delete (cancel) all queued jobs in a batch
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
     get:
       operationId: get_batch_v1_jobs__batch_id__get
       parameters:
@@ -22361,6 +22439,8 @@ paths:
       summary: Get batch details and execution status
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:read
   /v1/jobs/{batch_id}/jobs:
     get:
       operationId: get_batch_jobs_v1_jobs__batch_id__jobs_get
@@ -22644,6 +22724,8 @@ paths:
       summary: Get individual jobs within a batch
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:read
   /v1/jobs/{batch_id}/pause:
     post:
       operationId: pause_batch_v1_jobs__batch_id__pause_post
@@ -22688,6 +22770,8 @@ paths:
       summary: Pause all eligible jobs in a batch
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/jobs/{batch_id}/resume:
     post:
       operationId: resume_batch_v1_jobs__batch_id__resume_post
@@ -22732,6 +22816,8 @@ paths:
       summary: Resume all paused jobs in a batch
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/jobs/{batch_id}/retry:
     post:
       operationId: retry_batch_v1_jobs__batch_id__retry_post
@@ -22798,6 +22884,8 @@ paths:
       summary: Retry failed and dead-lettered jobs in a batch
       tags:
       - jobs
+      x-required-permissions:
+      - jobs:manage
   /v1/organizations:
     get:
       description: Retrieves a paginated list of organizations under the current organization
@@ -23361,52 +23449,6 @@ paths:
       summary: Update an IP restriction
       tags:
       - organization
-  /v1/organizations/roles:
-    get:
-      description: Retrieves a list of roles for the current organization
-      operationId: list_roles_v1_organizations_roles_get
-      responses:
-        '200':
-          content:
-            application/json:
-              schema: {}
-          description: Successful Response
-        '401':
-          content:
-            application/problem+json:
-              example:
-                code: ERROR_AUTHENTICATION
-                detail: Additional error context.
-                status: 401
-                title: Authentication Error
-                type: authentication
-              schema:
-                $ref: '#/components/schemas/Problem'
-          description: Unauthorized
-        '403':
-          content:
-            application/problem+json:
-              example:
-                code: ERROR_PERMISSION_DENIED
-                detail: Insufficient permissions to perform this action
-                status: 403
-                title: Permission Denied
-                type: permission-denied
-              schema:
-                $ref: '#/components/schemas/Problem'
-          description: Forbidden
-        '422':
-          content:
-            application/problem+json:
-              schema:
-                $ref: '#/components/schemas/HTTPValidationError'
-          description: Validation Error
-      security:
-      - OAuth2PasswordBearer: []
-      - APIKeyHeader: []
-      summary: List all roles
-      tags:
-      - organization
   /v1/organizations/users:
     get:
       description: Retrieves a paginated list of users under the current organization
@@ -23868,6 +23910,8 @@ paths:
       summary: List all invoices for the organization
       tags:
       - organization
+      x-required-permissions:
+      - billing:manage
   /v1/organizations/{organization_id}/pricing/product-type/{product_type}:
     get:
       description: Retrieves pricing data for a specific product type. If a product
@@ -24278,6 +24322,8 @@ paths:
       summary: List parking entries
       tags:
       - parking
+      x-required-permissions:
+      - parking:read
   /v1/parking/metrics:
     get:
       description: Retrieves aggregated metrics for all parking entries of the organization.
@@ -24344,6 +24390,8 @@ paths:
       summary: Get total metrics for all parking entries
       tags:
       - parking
+      x-required-permissions:
+      - parking:read
   /v1/parking/signup:
     post:
       description: Accept the parking agreement to enable parking features for your
@@ -24397,6 +24445,8 @@ paths:
       summary: Sign up for parking
       tags:
       - parking
+      x-required-permissions:
+      - parking:manage
   /v1/parking/signup/status:
     get:
       description: Check if your organization has accepted the parking agreement.
@@ -24444,6 +24494,8 @@ paths:
       summary: Get parking signup status
       tags:
       - parking
+      x-required-permissions:
+      - parking:read
   /v1/parking/{parking_reference}/metrics:
     get:
       description: Retrieves metrics for a specific parking entry by ID or domain
@@ -24536,6 +24588,8 @@ paths:
       summary: Get metrics for a parking entry
       tags:
       - parking
+      x-required-permissions:
+      - parking:read
   /v1/reports:
     get:
       operationId: list_reports_v1_reports_get
@@ -24792,6 +24846,8 @@ paths:
       summary: List tags
       tags:
       - tag
+      x-required-permissions:
+      - tags:read
     post:
       description: Create a new tag
       operationId: create_tag_v1_tags_post
@@ -24845,6 +24901,8 @@ paths:
       summary: Create a tag
       tags:
       - tag
+      x-required-permissions:
+      - tags:manage
   /v1/tags/objects:
     post:
       description: Add, remove, or replace tags on multiple objects at once. 'replace'
@@ -24913,6 +24971,8 @@ paths:
       summary: Bulk tag or untag objects
       tags:
       - tag
+      x-required-permissions:
+      - tags:manage
   /v1/tags/{tag_id}:
     delete:
       description: Delete a tag
@@ -24969,6 +25029,8 @@ paths:
       summary: Delete a tag
       tags:
       - tag
+      x-required-permissions:
+      - tags:delete
     get:
       description: Retrieve a single tag by its ID
       operationId: get_tag_v1_tags__tag_id__get
@@ -25028,6 +25090,8 @@ paths:
       summary: Get a tag
       tags:
       - tag
+      x-required-permissions:
+      - tags:read
     patch:
       description: Update a tag's label, description, or color
       operationId: update_tag_v1_tags__tag_id__patch
@@ -25106,6 +25170,8 @@ paths:
       summary: Update a tag
       tags:
       - tag
+      x-required-permissions:
+      - tags:manage
   /v1/tags/{tag_id}/objects:
     post:
       description: Add or remove objects from a tag. Objects are matched by the tag's
@@ -25173,6 +25239,8 @@ paths:
       summary: Tag or untag objects
       tags:
       - tag
+      x-required-permissions:
+      - tags:manage
   /v1/tlds/:
     get:
       description: Retrieves a list of TLD Specifications we have support for
@@ -25316,6 +25384,8 @@ paths:
       summary: Create a user
       tags:
       - user
+      x-required-permissions:
+      - users:manage
   /v1/users/me:
     get:
       description: Get the current user
@@ -25336,7 +25406,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/UserWithRelationPermissions'
+                $ref: '#/components/schemas/UserWithPermissions'
           description: Successful Response
         '422':
           content:
@@ -25349,6 +25419,8 @@ paths:
       summary: Get current user
       tags:
       - user
+      x-required-permissions:
+      - users:read
   /v1/users/me/password-reset:
     patch:
       operationId: change_password_v1_users_me_password_reset_patch
@@ -25384,6 +25456,8 @@ paths:
       summary: Change Password
       tags:
       - user
+      x-required-permissions:
+      - users:manage
   /v1/users/{user_id}:
     delete:
       description: Delete a user by ID
@@ -25439,6 +25513,8 @@ paths:
       summary: Delete a user
       tags:
       - user
+      x-required-permissions:
+      - users:delete
     get:
       description: Get a user by ID
       operationId: get_user_v1_users__user_id__get
@@ -25483,6 +25559,8 @@ paths:
       summary: Get a user
       tags:
       - user
+      x-required-permissions:
+      - users:read
     patch:
       description: Update a user by ID
       operationId: update_user_v1_users__user_id__patch
@@ -25523,6 +25601,8 @@ paths:
       summary: Update a user
       tags:
       - user
+      x-required-permissions:
+      - users:manage
   /v1/users/{user_id}/permissions:
     get:
       description: Get the permissions for a user
@@ -25544,7 +25624,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/PermissionSet'
+                $ref: '#/components/schemas/PublicPermissionSet'
           description: Successful Response
         '422':
           content:
@@ -25558,10 +25638,12 @@ paths:
       summary: Get user permissions
       tags:
       - user
-  /v1/users/{user_id}/roles:
+      x-required-permissions:
+      - users:read
+  /v1/users/{user_id}/role:
     get:
-      description: Get the roles for a user
-      operationId: list_roles_v1_users__user_id__roles_get
+      description: Get the role for a user
+      operationId: get_role_v1_users__user_id__role_get
       parameters:
       - in: path
         name: user_id
@@ -25579,7 +25661,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/RelationSet'
+                $ref: '#/components/schemas/PublicRoleAssignment'
           description: Successful Response
         '422':
           content:
@@ -25590,12 +25672,14 @@ paths:
       security:
       - OAuth2PasswordBearer: []
       - APIKeyHeader: []
-      summary: Get user roles
+      summary: Get user role
       tags:
       - user
-    patch:
-      description: Update the roles for a user
-      operationId: update_user_relations_v1_users__user_id__roles_patch
+      x-required-permissions:
+      - users:read
+    put:
+      description: Set the role for a user, replacing any existing role
+      operationId: set_user_role_v1_users__user_id__role_put
       parameters:
       - in: path
         name: user_id
@@ -25612,14 +25696,14 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/SpiceDbRelationshipUpdate'
+              $ref: '#/components/schemas/PublicRoleAssignment'
         required: true
       responses:
         '200':
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/RelationSet'
+                $ref: '#/components/schemas/PublicRoleAssignment'
           description: Successful Response
         '422':
           content:
@@ -25630,7 +25714,7 @@ paths:
       security:
       - OAuth2PasswordBearer: []
       - APIKeyHeader: []
-      summary: Update user roles
+      summary: Set user role
       tags:
       - user
 servers: