@productcraft/platform-auth 0.1.2 → 0.2.0

package/dist/index.d.cts

@@ -902,10 +902,15 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List PAKs in this workspace, newest first. Plaintext tokens are NOT returned — only prefixes + metadata. Pass `?limit=`/`?cursor=` to get the standard cursor-paginated `{data, pagination}` envelope (20/page, max 100); callers that pass neither still get the legacy bare JSON array. */
+        /**
+         * List the API keys in this workspace
+         * @description Newest first, as the standard cursor-paginated `{data, pagination}` envelope (20 per page, at most 100). Plaintext tokens are never returned, only prefixes and metadata.
+         *
+         *     **Deprecated legacy shape:** a request that sends neither `limit` nor `cursor` gets a bare JSON array of every key (capped at 1000), unless its `User-Agent` is a ProductCraft SDK (`productcraft-…`), which always gets the envelope. The array is kept only for `@productcraft/platform-auth` 0.0.x clients and is removed in the platform API's next major version; send `limit` (or use an SDK).
+         */
         get: operations["PlatformApiKeyController_list"];
         put?: never;
-        /** Mint a new PAK. Choose what it can do with `preset` (a ready-made set such as `mail-send`) or `policy_ids` (managed policies you wrote), never both. The plaintext `token` is returned ONCE — store it now, then call `GET /v1/api-keys/self` with it to check what it can do. The minter can grant at most their own effective permissions. Cookie/JWT only — PAKs cannot mint other PAKs. Not idempotent on purpose: replaying a stored mint response would mean keeping the plaintext token in a cache. */
+        /** Mint a new PAK. Choose what it can do with `preset` (a ready-made set such as `mail-send`) or `policy_ids` (managed policies you wrote), never both. The plaintext `token` is returned ONCE — store it now, then call `GET /v1/api-keys/self` with it to check what it can do. The minter can grant at most their own effective permissions. Cookie/JWT only — PAKs cannot mint other PAKs. Send an `Idempotency-Key` to make a retry safe: a retry of a mint that succeeded mints nothing and answers `409 PAK_ALREADY_MINTED` with that key's `id` (the token itself is never cached). */
         post: operations["PlatformApiKeyController_create"];
         delete?: never;
         options?: never;
@@ -1314,6 +1319,8 @@ interface components {
              */
             code: string;
         };
+        /** @enum {string} */
+        ApiKeyPresetKey: "mail-send" | "waitlist-write" | "trawl-jobs" | "readonly" | "full";
         ApiKeySelfResponseDto: {
             /**
              * @description The permission catalog actions behind `allowed`, in the same order.
@@ -1341,30 +1348,55 @@ interface components {
              * @description Id of the key that made this request.
              */
             key_id: string;
-            /** @example Production mailer */
+            /**
+             * @description Name given to the key when it was minted.
+             * @example Production mailer
+             */
             name: string;
+            /** @description The workspace the key belongs to. */
             workspace: components["schemas"]["ApiKeySelfWorkspaceDto"];
+            /**
+             * Format: uuid
+             * @description Id of the workspace the key belongs to (also `workspace.id`). The SDKs read it once per process to bind `workspace_id` on product calls.
+             */
+            workspace_id: string;
         };
         ApiKeySelfWorkspaceDto: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the key belongs to.
+             */
             id: string;
-            /** @example Acme */
+            /**
+             * @description Display name of the workspace.
+             * @example Acme
+             */
             name: string;
-            /** @example acme */
+            /**
+             * @description Slug of the workspace (the platform routes take it positionally).
+             * @example acme
+             */
             slug: string;
         };
+        /** @enum {string} */
+        ApiKeyStatus: "active" | "expired" | "revoked";
         AssertionAuthorizationRequestDto: {
             /** @description Action to decide, `<service>.<resource>.<verb>`. */
             action: string;
             /** @description URN the action targets. Omitted means `*`, the strict reading. */
             resource?: string;
         };
+        /** @enum {string} */
+        AuditActorType: "platform_user" | "system" | "pat";
         AuditFeedResponseDto: {
+            /** @description One page of feed items, newest first. */
             data: components["schemas"]["FeedItemDto"][];
             pagination: components["schemas"]["PaginationDto"];
             /** @description Per-source diagnostics so the UI / customer can see which sources contributed to this page and which are stubbed pending the cross-service fanout. */
             sources: components["schemas"]["SourceDiagnosticDto"][];
         };
+        /** @enum {string} */
+        AuditFeedSource: "workspace_audit" | "heimdall_audit" | "agora_moderation";
         AuthorizationServerMetadataDto: {
             /**
              * @description Non-standard. Declares that authority on this server is an IAM policy document stored on the grant, intersected per request with the authorizing human’s current workspace policy — so a demotion or an offboarding takes effect on the next call rather than at token expiry. The `scope` parameter only names a preset the human then narrows.
@@ -1381,6 +1413,7 @@ interface components {
              */
             code_challenge_methods_supported: string[];
             /**
+             * @description OAuth grant types the token endpoint accepts (RFC 8414).
              * @example [
              *       "authorization_code",
              *       "refresh_token"
@@ -1440,6 +1473,7 @@ interface components {
             /** @description RFC 6749 token endpoint. */
             token_endpoint: string;
             /**
+             * @description Client authentication methods the token endpoint accepts (RFC 8414).
              * @example [
              *       "none",
              *       "client_secret_basic",
@@ -1449,13 +1483,21 @@ interface components {
             token_endpoint_auth_methods_supported: string[];
         };
         AvatarUrlResponseDto: {
+            /** @description URL of the uploaded avatar image. */
             avatar_url: string;
         };
         BoundPolicySummaryDto: {
+            /** @description What the policy is for, when set. */
             description: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the policy.
+             */
             id: string;
-            /** @example mail-readonly */
+            /**
+             * @description Name of the policy.
+             * @example mail-readonly
+             */
             name: string;
         };
         CallbackBodyDto: {
@@ -1569,17 +1611,26 @@ interface components {
              * @description The human who consented to this grant.
              */
             account_id: string;
+            /** @description OAuth `client_id` of the connected app. */
             client_id: string;
+            /** @description Name the app registered with. */
             client_name: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When access was granted.
+             */
             created_at: string;
             /**
              * Format: date-time
              * @description When the assistant made its first successful tool call through this connection. Null until then, which is how a client that authorized but never worked shows up.
              */
             first_tool_call_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the grant (pass it to disconnect).
+             */
             grant_id: string;
+            /** @description Whether ProductCraft verified the app (dynamically registered apps never are). */
             is_verified: boolean;
             /** @description Policy the human approved. Effective authority is this intersected with the human's current workspace policy, per request. */
             policy: components["schemas"]["PolicyStatementDto"][];
@@ -1594,14 +1645,22 @@ interface components {
              *       "mail"
              *     ]
              */
-            products: ("auth" | "mail" | "waitlist" | "social" | "trawl")[] | null;
+            products: components["schemas"]["McpProduct"][] | null;
+            /** @description Resource indicator the grant's tokens are bound to. */
             resource: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the grant was revoked, or `null` while it is live.
+             */
             revoked_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the grant is scoped to.
+             */
             workspace_id: string;
         };
         ConnectedClientListDto: {
+            /** @description One page of connected apps. */
             data: components["schemas"]["ConnectedClientDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
@@ -1918,7 +1977,9 @@ interface components {
         };
         EnableWorkspaceServiceDto: {
             /** @description Optional per-service settings blob captured at enable time. */
-            settings?: Record<string, never>;
+            settings?: {
+                [key: string]: unknown;
+            };
         };
         ErrorParamDto: {
             /**
@@ -1983,7 +2044,10 @@ interface components {
              * @example mail.domain.verified
              */
             action: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the actor, or `null` for system actions.
+             */
             actor_id: string | null;
             /**
              * @description Actor classification — one of 'platform_user' | 'end_user' | 'm2m' | 'system' | 'pat' | 'api_key'.
@@ -1991,23 +2055,33 @@ interface components {
              */
             actor_type: string;
             /** @description Free-form metadata (jsonb). */
-            metadata: Record<string, never>;
-            /** @example workspace_membership */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description Kind of resource the action touched.
+             * @example workspace_membership
+             */
             resource: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the resource, when it has one.
+             */
             resource_id: string | null;
             /**
              * @description Which audit table this row came from.
              * @example workspace_audit
-             * @enum {string}
              */
-            source: "workspace_audit" | "heimdall_audit" | "agora_moderation";
+            source: components["schemas"]["AuditFeedSource"];
             /**
              * @description Stable per-source identifier. Used by the cursor to resume from the same point on the next page.
              * @example 4e5f5c9e-b4ee-4401-9275-283feb66c178
              */
             source_ref: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the action happened.
+             */
             timestamp: string;
         };
         FeedbackResponseDto: {
@@ -2036,55 +2110,90 @@ interface components {
         IntrospectAccountDto: {
             /** @description Public HTTPS URL of the uploaded avatar, or null when no avatar is set. */
             avatar_url: string | null;
+            /** @description Display name, when set. */
             display_name: string | null;
+            /** @description Primary email of the account, when it has one. */
             email: string | null;
             /**
              * Format: date-time
              * @description Timestamp when this account verified its primary email, or null if unverified.
              */
             email_verified_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the account.
+             */
             id: string;
             /** @description Account status (e.g. `active`, `suspended`). */
             status: string;
+            /** @description Unique username of the account. */
             username: string;
         };
         IntrospectApiKeyResponseDto: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the key.
+             */
             api_key_id: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the person who minted the key, or `null` when that account is gone.
+             */
             created_by: string | null;
+            /** @description Always `true` on a 200: unknown, revoked and expired keys answer 401. */
             is_valid: boolean;
             /** @description Merged effective policy across every managed policy bound to this PAK. */
             policy: components["schemas"]["PolicyStatementDto"][];
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the key belongs to.
+             */
             workspace_id: string;
         };
         IntrospectPrincipalDto: {
+            /** @description The account's primary email, when it has one. */
             email: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the authenticated account.
+             */
             id: string;
+            /** @description The account's display name, when set. */
             name: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description JWT subject: the account id.
+             */
             sub: string;
         };
         IntrospectResponseDto: {
+            /** @description The caller's account profile, or `null` when not authenticated. */
             account?: components["schemas"]["IntrospectAccountDto"] | null;
             /** @description False for an anonymous caller and for an access token whose session has been signed out. */
             is_authenticated: boolean;
+            /** @description The authenticated caller, or `null` when the request carries no valid session. */
             principal?: components["schemas"]["IntrospectPrincipalDto"] | null;
+            /** @description Workspaces the caller is a member of (empty when not authenticated). */
             workspaces?: components["schemas"]["IntrospectWorkspaceListItemDto"][];
         };
         IntrospectRoleDto: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the role (the key's workspace id for a workspace key).
+             */
             id: string;
+            /** @description Name of the role (`owner`, `admin`, `member`, a custom role, or `pak`). */
             name: string;
         };
         IntrospectWorkspaceListItemDto: {
             /** @description Workspace identity avatar (public HTTPS URL), or null when none is set. Console workspace switcher reads this. */
             avatar_url: string | null;
+            /** @description Display name of the workspace. */
             display_name: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             id: string;
             /**
              * @description Caller’s role name in this workspace.
@@ -2099,6 +2208,7 @@ interface components {
              *     ]
              */
             services: string[];
+            /** @description Slug of the workspace (platform routes take it positionally). */
             slug: string;
         };
         IntrospectWorkspaceResponseDto: {
@@ -2107,9 +2217,11 @@ interface components {
              * @description Canonical workspace UUID. Only present for members — non-members get a uniform low-information response.
              */
             id?: string;
+            /** @description Whether the caller is a member of the workspace (a workspace key bound to it counts as one). Non-members get no `id`, no role and an empty policy. */
             is_member: boolean;
             /** @description Effective IAM-style policy for this caller in this workspace. */
             policy: components["schemas"]["PolicyStatementDto"][];
+            /** @description The caller's role in the workspace (`{ id, name: 'pak' }` for a workspace key), or `null` for a non-member. */
             role: components["schemas"]["IntrospectRoleDto"] | null;
             /**
              * @description Enabled services on this workspace.
@@ -2175,38 +2287,47 @@ interface components {
             keys: components["schemas"]["JwkDto"][];
         };
         ListManagedPoliciesResponseDto: {
+            /** @description One page of managed policies. */
             data: components["schemas"]["ManagedPolicyResponseDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListPakPresetsResponseDto: {
+            /** @description Every preset a key can be minted from. */
             data: components["schemas"]["PakPresetDto"][];
             /** @description Always a single page: there are five presets. */
             pagination: components["schemas"]["PaginationDto"];
         };
         ListPlatformApiKeysResponseDto: {
+            /** @description One page of API keys, newest first. */
             data: components["schemas"]["PublicApiKeyDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListWorkspaceAuditLogsResponseDto: {
+            /** @description One page of audit log entries, newest first. */
             data: components["schemas"]["WorkspaceAuditLogEntryDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListWorkspaceInvitesResponseDto: {
+            /** @description One page of invites. */
             data: components["schemas"]["WorkspaceInviteListItemDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListWorkspaceMembersResponseDto: {
+            /** @description One page of workspace members. */
             data: components["schemas"]["WorkspaceMemberResponseDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListWorkspaceRolesResponseDto: {
+            /** @description One page of roles. */
             data: components["schemas"]["WorkspaceRoleResponseDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
         ListWorkspaceServicesResponseDto: {
+            /** @description Every product service and its state in this workspace. */
             data: components["schemas"]["WorkspaceServiceStateDto"][];
         };
         ListWorkspacesResponseDto: {
+            /** @description One page of workspaces the caller belongs to. */
             data: components["schemas"]["WorkspaceListItemDto"][];
             pagination: components["schemas"]["PaginationDto"];
         };
@@ -2224,10 +2345,10 @@ interface components {
              */
             bound_key_count: number;
             /**
+             * @description Always `true`: the policy is gone.
              * @example true
-             * @enum {number}
              */
-            deleted: true;
+            deleted: boolean;
             /**
              * Format: uuid
              * @description The deleted policy.
@@ -2242,71 +2363,109 @@ interface components {
              * @example 3
              */
             bound_key_count: number;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the policy was created.
+             */
             created_at: string;
             /**
              * Format: uuid
              * @description Account that authored the row. Only revealed to callers with `workspace.audit.read`; plain members see null.
              */
             created_by: string | null;
+            /** @description What the policy is for, when set. */
             description: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the policy.
+             */
             id: string;
-            /** @example mail-readonly */
+            /**
+             * @description Name of the policy, unique in the workspace.
+             * @example mail-readonly
+             */
             name: string;
             /** @description IAM-style policy statements bound to this managed policy. */
             policy: components["schemas"]["PolicyStatementDto"][];
             /**
              * @description The workspace-key preset this policy was created from, or null for a policy a person wrote. Minting a key with `preset` creates this policy once per workspace and reuses it. It stays set after the policy is edited, so show it as "based on preset".
              * @example mail-send
-             * @enum {string|null}
              */
-            preset_key: "mail-send" | "waitlist-write" | "trawl-jobs" | "readonly" | "full" | null;
-            /** Format: date-time */
+            preset_key: components["schemas"]["ApiKeyPresetKey"] | null;
+            /**
+             * Format: date-time
+             * @description When the policy was last changed.
+             */
             updated_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace that owns the policy.
+             */
             workspace_id: string;
         };
         ManagedPolicyResponseDto: {
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the policy was created.
+             */
             created_at: string;
             /**
              * Format: uuid
              * @description Account that authored the row. Only revealed to callers with `workspace.audit.read`; plain members see null.
              */
             created_by: string | null;
+            /** @description What the policy is for, when set. */
             description: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the policy.
+             */
             id: string;
-            /** @example mail-readonly */
+            /**
+             * @description Name of the policy, unique in the workspace.
+             * @example mail-readonly
+             */
             name: string;
             /** @description IAM-style policy statements bound to this managed policy. */
             policy: components["schemas"]["PolicyStatementDto"][];
             /**
              * @description The workspace-key preset this policy was created from, or null for a policy a person wrote. Minting a key with `preset` creates this policy once per workspace and reuses it. It stays set after the policy is edited, so show it as "based on preset".
              * @example mail-send
-             * @enum {string|null}
              */
-            preset_key: "mail-send" | "waitlist-write" | "trawl-jobs" | "readonly" | "full" | null;
-            /** Format: date-time */
+            preset_key: components["schemas"]["ApiKeyPresetKey"] | null;
+            /**
+             * Format: date-time
+             * @description When the policy was last changed.
+             */
             updated_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace that owns the policy.
+             */
             workspace_id: string;
         };
+        /** @enum {string} */
+        McpProduct: "auth" | "mail" | "waitlist" | "social" | "trawl";
         MeProfileDto: {
             /** @description Short-lived (15 min) presigned GET URL for the avatar object in private object storage. NULL when no avatar has been set; the frontend then renders initials. The API mints a fresh URL on every response, so a stable bookmark of this value is not meaningful. */
             avatar_url: string | null;
+            /** @description Your display name, when set. */
             display_name: string | null;
+            /** @description Your primary email, when you have one. */
             email: string | null;
             /**
              * Format: date-time
              * @description Timestamp when this account verified its primary email, or null if unverified.
              */
             email_verified_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of your account.
+             */
             id: string;
             /** @description Account status (e.g. `active`, `suspended`). */
             status: string;
+            /** @description Your username. */
             username: string;
         };
         MintPakResponseDto: {
@@ -2336,10 +2495,41 @@ interface components {
              */
             error_description: string;
         };
+        OAuthTokenResponseDto: {
+            /** @description Signed JWT, audience-bound to the resource indicator and carrying the workspace, the preset name and the client id. It carries no policy — authority is resolved per request from the grant row and the human’s live policy. */
+            access_token: string;
+            /**
+             * @description Seconds until the access token expires (≤ 900).
+             * @example 900
+             */
+            expires_in: number;
+            /** @description The policy this token carries. Effective authority is this intersected with the authorizing human's current workspace policy, re-evaluated on every call. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            /** @description Rotating refresh token. The one presented is consumed; replaying it revokes the whole grant family. */
+            refresh_token: string;
+            /**
+             * @description Preset name(s) the grant started from. Present for RFC 6749 §5.1 compliance; it is not the authority — `policy` is.
+             * @example mail
+             */
+            scope: string;
+            /** @example Bearer */
+            token_type: string;
+            /**
+             * Format: uuid
+             * @description Workspace the grant is scoped to.
+             */
+            workspace_id: string;
+        };
         PaginationDto: {
-            /** @example false */
+            /**
+             * @description Whether another page follows this one.
+             * @example false
+             */
             has_more: boolean;
-            /** @example null */
+            /**
+             * @description Pass as `cursor` to get the next page; `null` on the last page.
+             * @example null
+             */
             next_cursor: string | null;
         };
         PakGrantPreviewDto: {
@@ -2382,14 +2572,20 @@ interface components {
              *     ]
              */
             allowed: string[];
-            /** @example Send email from your verified domains and check what happened to it. Cannot read message bodies or change domains. */
+            /**
+             * @description What a key minted from this preset can do.
+             * @example Send email from your verified domains and check what happened to it. Cannot read message bodies or change domains.
+             */
             description: string;
             /**
+             * @description Preset to pass as `preset` when minting a key.
              * @example mail-send
-             * @enum {string}
              */
-            key: "mail-send" | "waitlist-write" | "trawl-jobs" | "readonly" | "full";
-            /** @example Send email */
+            key: components["schemas"]["ApiKeyPresetKey"];
+            /**
+             * @description Short human label for the preset.
+             * @example Send email
+             */
             label: string;
             /**
              * Format: uuid
@@ -2398,13 +2594,15 @@ interface components {
             policy_id: string | null;
         };
         /** @description Error codes this API returns (open set: a client must accept codes it does not know; new codes are not a breaking change). Each is documented at https://productcraft.co/docs/errors#<code>. */
-        PlatformErrorCode: ("BAD_REQUEST" | "VALIDATION_ERROR" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "UNSUPPORTED_MEDIA_TYPE" | "UNPROCESSABLE_ENTITY" | "PRECONDITION_REQUIRED" | "RATE_LIMITED" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "SERVICE_NOT_ENABLED" | "INVALID_CREDENTIALS" | "SESSION_REVOKED" | "MCP_NOT_PERMITTED" | "MCP_WORKSPACE_MISMATCH" | "PAK_NOT_PERMITTED" | "ACTIONS_NOT_GRANTABLE" | "IDEMPOTENCY_KEY_REUSE" | "IDEMPOTENCY_KEY_REQUIRED" | "WEBHOOK_ENDPOINT_LIMIT" | "WEBHOOK_ENDPOINT_NOT_FOUND" | "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED" | "WEBHOOK_EVENT_NOT_FOUND" | "WEBHOOK_EVENT_TYPE_UNKNOWN" | "ACCOUNT_DEACTIVATED" | "ACCOUNT_SUSPENDED" | "ALREADY_A_MEMBER" | "CROSS_ORIGIN_REJECTED" | "EMAIL_NOT_VERIFIED" | "INVITE_EMAIL_MISMATCH" | "INVITE_EXHAUSTED" | "INVITE_EXPIRED" | "INVITE_INVALID" | "INVITE_NOT_FOUND" | "INVITE_REVOKED" | "LAST_MEMBER" | "MEMBER_RANK_EXCEEDED" | "NOT_A_MEMBER" | "OAUTH_GRANT_ADMIN_REVOKED" | "OWNER_ROLE_REQUIRED" | "PAK_EXPIRED" | "PAK_NAME_REQUIRED" | "PAK_NAME_TOO_LONG" | "PAK_NOT_FOUND" | "PAK_REVOKED" | "PASSWORD_RESET_INVALID" | "POLICY_INVALID" | "POLICY_NAME_TAKEN" | "POLICY_NOT_FOUND" | "ROLE_HAS_MEMBERS" | "ROLE_NAME_TAKEN" | "ROLE_NOT_FOUND" | "ROLE_SYSTEM_IMMUTABLE" | "SERVICE_NOT_ACTIVATED" | "SERVICE_UNKNOWN" | "SOLE_OWNER" | "TOO_MANY_ATTEMPTS" | "WORKSPACE_KEY_REQUIRED") | string;
+        PlatformErrorCode: ("BAD_REQUEST" | "VALIDATION_ERROR" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "UNSUPPORTED_MEDIA_TYPE" | "UNPROCESSABLE_ENTITY" | "PRECONDITION_REQUIRED" | "RATE_LIMITED" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "SERVICE_NOT_ENABLED" | "INVALID_CREDENTIALS" | "SESSION_REVOKED" | "MCP_NOT_PERMITTED" | "MCP_WORKSPACE_MISMATCH" | "PAK_NOT_PERMITTED" | "ACTIONS_NOT_GRANTABLE" | "IDEMPOTENCY_KEY_REUSE" | "IDEMPOTENCY_KEY_REQUIRED" | "IDEMPOTENCY_IN_PROGRESS" | "WEBHOOK_ENDPOINT_LIMIT" | "WEBHOOK_ENDPOINT_NOT_FOUND" | "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED" | "WEBHOOK_EVENT_NOT_FOUND" | "WEBHOOK_EVENT_TYPE_UNKNOWN" | "ACCOUNT_DEACTIVATED" | "ACCOUNT_SUSPENDED" | "ALREADY_A_MEMBER" | "CROSS_ORIGIN_REJECTED" | "EMAIL_NOT_VERIFIED" | "INVITE_EMAIL_MISMATCH" | "INVITE_EXHAUSTED" | "INVITE_EXPIRED" | "INVITE_INVALID" | "INVITE_NOT_FOUND" | "INVITE_REVOKED" | "LAST_MEMBER" | "MEMBER_RANK_EXCEEDED" | "NOT_A_MEMBER" | "OAUTH_GRANT_ADMIN_REVOKED" | "OWNER_ROLE_REQUIRED" | "PAK_ALREADY_MINTED" | "PAK_EXPIRED" | "PAK_NAME_REQUIRED" | "PAK_NAME_TOO_LONG" | "PAK_NOT_FOUND" | "PAK_REVOKED" | "PASSWORD_RESET_INVALID" | "POLICY_INVALID" | "POLICY_NAME_TAKEN" | "POLICY_NOT_FOUND" | "ROLE_HAS_MEMBERS" | "ROLE_NAME_TAKEN" | "ROLE_NOT_FOUND" | "ROLE_SYSTEM_IMMUTABLE" | "SERVICE_NOT_ACTIVATED" | "SERVICE_UNKNOWN" | "SOLE_OWNER" | "TOO_MANY_ATTEMPTS" | "WORKSPACE_KEY_REQUIRED") | string;
         PolicyBindingCountDto: {
             /** @description Number of platform API keys bound to this policy. */
             pak: number;
             /** @description Number of workspace roles bound to this policy. */
             role: number;
         };
+        /** @enum {string} */
+        PolicyEffect: "allow" | "deny";
         PolicyStatementDto: {
             /**
              * @description Action strings the statement applies to. Wildcards (e.g. `social.*`, `*.read`, `*`) supported per `actionMatches` semantics.
@@ -2417,9 +2615,8 @@ interface components {
             /**
              * @description Whether the statement allows or denies the listed actions on the listed resources.
              * @example allow
-             * @enum {string}
              */
-            effect: "allow" | "deny";
+            effect: components["schemas"]["PolicyEffect"];
             /**
              * @description Resource URNs the statement applies to. Use `["*"]` for workspace-wide. Per-resource scoping (e.g. `pcft:agora:community/<uuid>`) is supported by the PAK lane today; the workspace-role authoring API restricts this to `["*"]` for now (see `tasks/platform-auth-api/001`).
              * @example [
@@ -2444,43 +2641,63 @@ interface components {
             preset?: "mail-send" | "waitlist-write" | "trawl-jobs" | "readonly" | "full";
         };
         PublicApiKeyDto: {
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the key was minted.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of who minted the key, or `null` when that account is gone.
+             */
             created_by: string | null;
+            /** @description What the key is for, when set. */
             description: string | null;
             /**
              * Format: date-time
              * @description When this key stops introspecting. `null` means it never expires.
              */
             expires_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the key.
+             */
             id: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the key last authenticated a request, or `null` if never.
+             */
             last_used_at: string | null;
+            /** @description Name of the key. */
             name: string;
             /** @description Managed policies currently bound to this PAK. */
             policies: components["schemas"]["BoundPolicySummaryDto"][];
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the key was revoked, or `null` while it is not.
+             */
             revoked_at: string | null;
             /**
              * Format: uuid
              * @description Id of the key this one replaced, when it was minted by a rotation.
              */
             rotated_from: string | null;
-            /**
-             * @description Lifecycle state at the time of the request. Only `active` keys introspect. `revoked` beats `expired` — revocation is a deliberate act by a named actor and the row keeps saying so.
-             * @enum {string}
-             */
-            status: "active" | "expired" | "revoked";
+            /** @description Lifecycle state at the time of the request. Only `active` keys introspect. `revoked` beats `expired` — revocation is a deliberate act by a named actor and the row keeps saying so. */
+            status: components["schemas"]["ApiKeyStatus"];
             /**
              * @description The first ~14 chars of the token (prefix). Plaintext token is never returned after mint.
              * @example pcft_live_abc123
              */
             token_prefix: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the key was last changed.
+             */
             updated_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the key belongs to.
+             */
             workspace_id: string;
         };
         RefreshDto: {
@@ -2621,7 +2838,7 @@ interface components {
              * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
              * @example short
              */
-            session_duration?: Record<string, never>;
+            session_duration?: ("short" | "long") | number;
         };
         SignUpDto: {
             /**
@@ -2643,7 +2860,7 @@ interface components {
              * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
              * @example long
              */
-            session_duration?: Record<string, never>;
+            session_duration?: ("short" | "long") | number;
             /**
              * @description Unique username (letters, numbers, dot, underscore, hyphen)
              * @example john_doe
@@ -2651,12 +2868,19 @@ interface components {
             username: string;
         };
         SourceDiagnosticDto: {
+            /** @description How many rows the source contributed. */
             count: number;
+            /** @description Why the source was skipped, when it failed (the feed still answers with the others). */
             error?: string;
+            /** @description Whether the source contributed rows to this page. */
             included: boolean;
-            /** @enum {string} */
-            source: "workspace_audit" | "heimdall_audit" | "agora_moderation";
+            /** @description The audit source this diagnostic describes. */
+            source: components["schemas"]["AuditFeedSource"];
         };
+        /** @enum {string} */
+        StatsGranularity: "day";
+        /** @enum {string} */
+        StatsMetric: "audit_events";
         StatsSeriesPointDto: {
             /**
              * Format: date
@@ -2670,6 +2894,8 @@ interface components {
              */
             value: number;
         };
+        /** @enum {string} */
+        StatsWindow: "1d" | "7d" | "30d";
         TokenRequestDto: {
             /** @description Client identifier. Required for public clients; confidential clients may instead use HTTP Basic. */
             client_id?: string;
@@ -2694,29 +2920,26 @@ interface components {
             scope?: string;
         };
         TokenResponseDto: {
-            /** @description Signed JWT, audience-bound to the resource indicator and carrying the workspace, the preset name and the client id. It carries no policy — authority is resolved per request from the grant row and the human’s live policy. */
+            /**
+             * @description Access token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+             */
             access_token: string;
             /**
-             * @description Seconds until the access token expires (≤ 900).
-             * @example 900
+             * @description Access token TTL in seconds
+             * @example 3600
              */
             expires_in: number;
-            /** @description The policy this token carries. Effective authority is this intersected with the authorizing human's current workspace policy, re-evaluated on every call. */
-            policy: components["schemas"]["PolicyStatementDto"][];
-            /** @description Rotating refresh token. The one presented is consumed; replaying it revokes the whole grant family. */
-            refresh_token: string;
             /**
-             * @description Preset name(s) the grant started from. Present for RFC 6749 §5.1 compliance; it is not the authority — `policy` is.
-             * @example mail
+             * @description Refresh token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
              */
-            scope: string;
-            /** @example Bearer */
-            token_type: string;
+            refresh_token?: string;
             /**
-             * Format: uuid
-             * @description Workspace the grant is scoped to.
+             * @description Token type
+             * @example Bearer
              */
-            workspace_id: string;
+            token_type: string;
         };
         UpdateMemberRoleDto: {
             /**
@@ -2731,21 +2954,41 @@ interface components {
             role_id?: string;
         };
         UpdateMemberRoleResponseDto: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the member's account.
+             */
             account_id: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the membership.
+             */
             id: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the member who invited them, when they joined by invite.
+             */
             invited_by: string | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the member joined the workspace.
+             */
             joined_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the member's new role.
+             */
             role_id: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             workspace_id: string;
         };
         UpdatePakDto: {
+            /** @description New description of the key, or `null` to clear it. */
             description?: string | null;
+            /** @description New name of the key. */
             name?: string;
         };
         UpdateProfileDto: {
@@ -2753,9 +2996,12 @@ interface components {
             display_name?: string;
         };
         UpdateWorkspaceDto: {
+            /** @description New display name of the workspace. */
             display_name?: string;
             /** @description Free-form workspace settings blob. */
-            settings?: Record<string, never>;
+            settings?: {
+                [key: string]: unknown;
+            };
             /**
              * @description New URL-friendly slug. Same constraints as the create form. Renames are broadcast on the workspace events queue so denormalised consumers (waitlist-api, future product surfaces) can sync. Old URLs continue to resolve for one rename cycle.
              * @example acme
@@ -2791,7 +3037,9 @@ interface components {
             policy?: components["schemas"]["PolicyStatementDto"][];
         };
         UpdateWorkspaceRoleDto: {
+            /** @description New description of the role. */
             description?: string;
+            /** @description New name of the role. */
             name?: string;
             /** @description Replaces the role policy if provided. Omit to leave policy unchanged. */
             policy?: components["schemas"]["PolicyStatementDto"][];
@@ -2820,83 +3068,162 @@ interface components {
             /**
              * @description Actor classification.
              * @example platform_user
-             * @enum {string}
              */
-            actor_type: "platform_user" | "system" | "pat";
-            /** Format: date-time */
+            actor_type: components["schemas"]["AuditActorType"];
+            /**
+             * Format: date-time
+             * @description When the action happened.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the entry.
+             */
             id: string;
             /** @description Originating request IP, when available. */
             ip: string | null;
             /** @description Free-form metadata attached to the audit row (jsonb). */
-            metadata: Record<string, never>;
+            metadata: {
+                [key: string]: unknown;
+            };
             /**
              * @description Resource type the action targeted.
              * @example workspace_membership
              */
             resource: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the resource the action touched, when it has one.
+             */
             resource_id: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             workspace_id: string;
         };
         WorkspaceAvatarUrlResponseDto: {
+            /** @description URL of the uploaded avatar image. */
             avatar_url: string;
         };
         WorkspaceInviteListItemDto: {
             /** @description Single-use invite code embedded in the invite URL. */
             code: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite was created.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the member who created the invite.
+             */
             created_by: string;
-            /** Format: email */
+            /**
+             * Format: email
+             * @description Email the invite is restricted to, or `null` for an open invite link.
+             */
             email: string | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite stops working, or `null` if it never expires.
+             */
             expires_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the invite.
+             */
             id: string;
+            /** @description How many times the invite can be accepted, or `null` for unlimited. */
             max_uses: number | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite was revoked, or `null` while it is live.
+             */
             revoked_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the role the invitee gets, or `null` for the default member role.
+             */
             role_id: string | null;
+            /** @description Name of the role the invitee gets, or `null` for the default member role. */
             role_name: string | null;
+            /** @description How many times the invite has been accepted. */
             use_count: number;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the invite joins.
+             */
             workspace_id: string;
         };
         WorkspaceInviteResponseDto: {
             /** @description Single-use invite code embedded in the invite URL. */
             code: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite was created.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the member who created the invite.
+             */
             created_by: string;
-            /** Format: email */
+            /**
+             * Format: email
+             * @description Email the invite is restricted to, or `null` for an open invite link.
+             */
             email: string | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite stops working, or `null` if it never expires.
+             */
             expires_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the invite.
+             */
             id: string;
+            /** @description How many times the invite can be accepted, or `null` for unlimited. */
             max_uses: number | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the invite was revoked, or `null` while it is live.
+             */
             revoked_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the role the invitee gets, or `null` for the default member role.
+             */
             role_id: string | null;
+            /** @description How many times the invite has been accepted. */
             use_count: number;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace the invite joins.
+             */
             workspace_id: string;
         };
         WorkspaceListItemDto: {
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the workspace was created.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the member who created the workspace.
+             */
             created_by: string;
-            /** @example Acme Corp */
+            /**
+             * @description Display name of the workspace.
+             * @example Acme Corp
+             */
             display_name: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             id: string;
             /**
              * @description Caller’s role name in this workspace.
@@ -2909,58 +3236,107 @@ interface components {
              */
             member_role_id: string | null;
             /** @description Free-form workspace settings blob. */
-            settings: Record<string, never>;
-            /** @example acme-corp */
+            settings: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description Unique URL-friendly slug; platform routes take it positionally.
+             * @example acme-corp
+             */
             slug: string;
             /**
              * @description Workspace status (e.g. `active`).
              * @example active
              */
             status: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the workspace was last changed.
+             */
             updated_at: string;
         };
         WorkspaceMemberResponseDto: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the member's account.
+             */
             account_id: string;
             /** @description Presigned URL for the member's uploaded avatar, or null when they have none. Short-lived — mint a fresh one by re-reading this endpoint rather than caching the URL. */
             avatar_url: string | null;
+            /** @description The member's display name, when set. */
             display_name: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the membership.
+             */
             id: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the member joined the workspace.
+             */
             joined_at: string;
+            /** @description The member's primary email, when it has one. */
             primary_email: string | null;
+            /** @description Name of the member's role. */
             role: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the member's role in this workspace.
+             */
             role_id: string;
+            /** @description Whether the role is a system role (`owner`, `admin`, `member`) rather than a custom one. */
             role_is_system: boolean;
+            /** @description The member's username. */
             username: string;
         };
         WorkspaceResponseDto: {
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the workspace was created.
+             */
             created_at: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of the member who created the workspace.
+             */
             created_by: string;
-            /** @example Acme Corp */
+            /**
+             * @description Display name of the workspace.
+             * @example Acme Corp
+             */
             display_name: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             id: string;
             /** @description Free-form workspace settings blob. */
-            settings: Record<string, never>;
-            /** @example acme-corp */
+            settings: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description Unique URL-friendly slug; platform routes take it positionally.
+             * @example acme-corp
+             */
             slug: string;
             /**
              * @description Workspace status (e.g. `active`).
              * @example active
              */
             status: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the workspace was last changed.
+             */
             updated_at: string;
         };
         WorkspaceRoleResponseDto: {
+            /** @description What the role is for, when set. */
             description: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Id of the role.
+             */
             id: string;
             /** @description True for built-in system roles (owner/admin/member); false for custom roles. */
             is_system: boolean;
@@ -2975,14 +3351,27 @@ interface components {
             policy_id: string | null;
         };
         WorkspaceServiceStateDto: {
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the service was last turned off, or `null`.
+             */
             disabled_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of who last turned it off, or `null`.
+             */
             disabled_by: string | null;
+            /** @description Whether the service is on for the workspace. */
             enabled: boolean;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the service was last turned on, or `null` if never.
+             */
             enabled_at: string | null;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Account id of who last turned it on, or `null`.
+             */
             enabled_by: string | null;
             /**
              * @description Service identifier (e.g. `mail`, `waitlist`, `social`, `auth`).
@@ -2990,8 +3379,13 @@ interface components {
              */
             service: string;
             /** @description Per-service settings blob (service-specific shape). */
-            settings: Record<string, never>;
-            /** Format: uuid */
+            settings: {
+                [key: string]: unknown;
+            };
+            /**
+             * Format: uuid
+             * @description Id of the workspace.
+             */
             workspace_id: string;
         };
         WorkspaceStatsDto: {
@@ -3016,9 +3410,8 @@ interface components {
             /**
              * @description Window the counts cover.
              * @example 30d
-             * @enum {string}
              */
-            window: "1d" | "7d" | "30d";
+            window: components["schemas"]["StatsWindow"];
         };
         WorkspaceStatsInWindowDto: {
             /**
@@ -3037,15 +3430,13 @@ interface components {
             /**
              * @description Bucket width.
              * @example day
-             * @enum {string}
              */
-            granularity: "day";
+            granularity: components["schemas"]["StatsGranularity"];
             /**
              * @description Admin-change audit events per UTC day of `created_at` (same rows as `in_window.audit_events`: reads, sign-ins and MCP tool-call rows excluded).
              * @example audit_events
-             * @enum {string}
              */
-            metric: "audit_events";
+            metric: components["schemas"]["StatsMetric"];
             /** @description Dense and zero-filled: one point per UTC day in the window, oldest first, ending today. */
             points: components["schemas"]["StatsSeriesPointDto"][];
         };
@@ -3090,6 +3481,18 @@ interface operations {
                     "application/json": components["schemas"]["JwksResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     AuthorizationServerMetadataController_metadata: {
@@ -3110,6 +3513,18 @@ interface operations {
                     "application/json": components["schemas"]["AuthorizationServerMetadataDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     AccountController_deleteAccount: {
@@ -3159,6 +3574,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiKeySelfController_self: {
@@ -3209,6 +3636,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     AuthenticationController_logout: {
@@ -3242,6 +3681,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     AuthenticationController_logoutCurrent: {
@@ -3271,6 +3722,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthController_callback: {
@@ -3278,6 +3741,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description The sign-in provider: `google`, `github` or `apple`.
+                 * @example google
+                 */
                 provider: "apple" | "google" | "github";
             };
             cookie?: never;
@@ -3317,6 +3784,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthController_start: {
@@ -3327,7 +3806,10 @@ interface operations {
             };
             header?: never;
             path: {
-                /** @description OAuth provider id. Providers are gated on env-var configuration; unconfigured providers 400 with UNKNOWN_OAUTH_PROVIDER. */
+                /**
+                 * @description OAuth provider id. Providers are gated on env-var configuration; unconfigured providers 400 with UNKNOWN_OAUTH_PROVIDER.
+                 * @example google
+                 */
                 provider: "apple" | "google" | "github";
             };
             cookie?: never;
@@ -3352,6 +3834,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PasswordController_requestPasswordReset: {
@@ -3385,9 +3879,11 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. */
+            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -3428,9 +3924,11 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. */
+            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -3473,6 +3971,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     AuthenticationController_signin: {
@@ -3528,9 +4038,11 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Too many attempts for this identifier (`TOO_MANY_ATTEMPTS`). Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after 4 failed attempts. Both fire on the same attempt for a registered and an unregistered identifier. */
+            /** @description Too many attempts for this identifier (`TOO_MANY_ATTEMPTS`). Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after 4 failed attempts. Both fire on the same attempt for a registered and an unregistered identifier. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -3573,6 +4085,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     IntrospectController_introspect: {
@@ -3593,9 +4117,11 @@ interface operations {
                     "application/json": components["schemas"]["IntrospectResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. */
+            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -3608,9 +4134,7 @@ interface operations {
     IntrospectController_introspectApiKey: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -3635,6 +4159,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     IntrospectController_introspectWorkspace: {
@@ -3642,6 +4178,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the workspace.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 workspace_id: string;
             };
             cookie?: never;
@@ -3677,6 +4217,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     MeController_getMe: {
@@ -3717,6 +4269,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     MeController_setAvatar: {
@@ -3767,6 +4331,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     MeController_removeAvatar: {
@@ -3796,6 +4372,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     HiddenGuidesController_list: {
@@ -3836,6 +4424,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     HiddenGuidesController_showAll: {
@@ -3875,6 +4475,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     HiddenGuidesController_hide: {
@@ -3882,7 +4494,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                /**
+                 * @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+                 * @example dashboard
+                 */
                 key: string;
             };
             cookie?: never;
@@ -3929,6 +4544,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     HiddenGuidesController_show: {
@@ -3936,7 +4563,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                /**
+                 * @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+                 * @example dashboard
+                 */
                 key: string;
             };
             cookie?: never;
@@ -3981,6 +4611,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     MeController_updateProfile: {
@@ -4035,22 +4677,42 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_authorize: {
         parameters: {
             query: {
-                /** @description Comma-separated products to pre-select on the consent screen (`auth`, `mail`, `waitlist`, `social`, `trawl`). A pre-selection only: the human decides. Unknown names are ignored. */
+                /**
+                 * @description Comma-separated products to pre-select on the consent screen (`auth`, `mail`, `waitlist`, `social`, `trawl`). A pre-selection only: the human decides. Unknown names are ignored.
+                 * @example mail,waitlist
+                 */
                 products?: unknown;
                 /** @description RFC 8707 resource indicator. Becomes the access token `aud`. It may carry `?products=mail,waitlist`, which pre-selects products on the consent screen and is removed from the audience. */
                 resource?: unknown;
                 state?: unknown;
+                /** @example S256 */
                 code_challenge_method: unknown;
                 code_challenge: unknown;
-                /** @description Space-delimited preset names (`readonly`, `mail`, `support`, `full`). A preset resolves to a policy template the human narrows on the consent screen; it is never authority in itself. */
+                /**
+                 * @description Space-delimited preset names (`readonly`, `mail`, `support`, `full`). A preset resolves to a policy template the human narrows on the consent screen; it is never authority in itself.
+                 * @example mail
+                 */
                 scope: unknown;
                 redirect_uri: unknown;
                 client_id: unknown;
+                /** @example code */
                 response_type: unknown;
             };
             header?: never;
@@ -4077,14 +4739,32 @@ interface operations {
                     "application/json": components["schemas"]["OAuthErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_connections: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
             };
             header?: never;
@@ -4123,6 +4803,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_disconnect: {
@@ -4130,6 +4822,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the grant.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 grant_id: string;
             };
             cookie?: never;
@@ -4164,6 +4860,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_consentRequest: {
@@ -4171,6 +4879,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the request.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 request_id: string;
             };
             cookie?: never;
@@ -4226,6 +4938,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_decide: {
@@ -4233,6 +4957,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the request.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 request_id: string;
             };
             cookie?: never;
@@ -4302,14 +5030,24 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthDelegatedAuthorizationController_authorize: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -4338,14 +5076,24 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthDelegatedAuthorizationController_authorizeAssertion: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -4374,14 +5122,24 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthDelegatedAuthorizationController_authorizeBatch: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -4420,14 +5178,24 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthDelegatedAuthorizationController_downstreamAssertion: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -4466,14 +5234,24 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthDelegatedAuthorizationController_firstToolCall: {
         parameters: {
             query?: never;
-            header: {
-                authorization: string;
-            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
@@ -4497,6 +5275,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthTokenController_introspect: {
@@ -4531,6 +5321,18 @@ interface operations {
                     "application/json": components["schemas"]["OAuthErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthRegistrationController_register: {
@@ -4565,9 +5367,11 @@ interface operations {
                     "application/json": components["schemas"]["OAuthErrorResponseDto"];
                 };
             };
-            /** @description `invalid_request` — too many registrations from this IP. */
+            /** @description `invalid_request` — too many registrations from this IP. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -4618,6 +5422,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthRegistrationController_update: {
@@ -4655,6 +5471,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthTokenController_revoke: {
@@ -4688,6 +5516,18 @@ interface operations {
                     "application/json": components["schemas"]["OAuthErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthTokenController_token: {
@@ -4709,7 +5549,7 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["TokenResponseDto"];
+                    "application/json": components["schemas"]["OAuthTokenResponseDto"];
                 };
             };
             /** @description `invalid_request`, `invalid_grant`, `invalid_scope`, `invalid_target`, or `unsupported_grant_type`. */
@@ -4732,18 +5572,40 @@ interface operations {
                     "application/json": components["schemas"]["OAuthErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_workspaceConnections: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Id of the workspace.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 workspace_id: string;
             };
             cookie?: never;
@@ -4790,6 +5652,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_disconnectWorkspaceConnection: {
@@ -4797,7 +5671,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the workspace.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 workspace_id: string;
+                /**
+                 * @description Id of the grant.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 grant_id: string;
             };
             cookie?: never;
@@ -4842,6 +5724,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     OAuthAuthorizeController_restoreWorkspaceConnection: {
@@ -4849,7 +5743,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the workspace.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 workspace_id: string;
+                /**
+                 * @description Id of the grant.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 grant_id: string;
             };
             cookie?: never;
@@ -4904,6 +5806,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     SessionController_getSessions: {
@@ -4935,6 +5849,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     SessionController_revokeOtherSessions: {
@@ -4975,6 +5901,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     SessionController_revokeSession: {
@@ -4982,6 +5920,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Id of the session.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -5028,6 +5970,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     VerificationController_resend: {
@@ -5059,6 +6013,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     VerificationController_verify: {
@@ -5094,13 +6060,33 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_listWorkspaces: {
         parameters: {
-            query: {
-                limit: string;
-                cursor: string;
+            query?: {
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
+                cursor?: string;
             };
             header?: never;
             path?: never;
@@ -5137,12 +6123,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_createWorkspace: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that deduplicates retries for 24 h. A retry with the same key and body returns the first response with `Idempotent-Replay: true` instead of creating a second resource. The SDKs send one on every create. */
+                "Idempotency-Key"?: string;
+            };
             path?: never;
             cookie?: never;
         };
@@ -5154,6 +6155,8 @@ interface operations {
         responses: {
             201: {
                 headers: {
+                    /** @description `true` when this response is a replay of an earlier request with the same `Idempotency-Key`. */
+                    "Idempotent-Replay"?: "true";
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -5181,6 +6184,30 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key). */
+            409: {
+                headers: {
+                    /** @description Seconds to wait before retrying with the same key (sent with `IDEMPOTENCY_IN_PROGRESS`). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_acceptInvite: {
@@ -5266,9 +6293,11 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. */
+            /** @description Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
             429: {
                 headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -5281,12 +6310,18 @@ interface operations {
     WorkspaceStatsController_get: {
         parameters: {
             query?: {
-                /** @description Window for `in_window` and the length of `series`, in UTC days ending today. */
+                /**
+                 * @description Window for `in_window` and the length of `series`, in UTC days ending today.
+                 * @example 30d
+                 */
                 window?: "1d" | "7d" | "30d";
             };
             header?: never;
             path: {
-                /** @description Workspace id. */
+                /**
+                 * @description Workspace id.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 workspace_id: string;
             };
             cookie?: never;
@@ -5343,6 +6378,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_getWorkspace: {
@@ -5350,6 +6397,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5395,6 +6446,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_deleteWorkspace: {
@@ -5402,6 +6465,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5436,6 +6503,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_updateWorkspace: {
@@ -5443,6 +6522,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5503,39 +6586,59 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_list: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. Sending it (at any value) also opts the response into the `{data, pagination}` envelope. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. Sending it also opts the response into the `{data, pagination}` envelope. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
-                /** @description Send `false` to leave revoked keys out (the console's default view). Expired keys are still listed: they show what needs replacing. Applies to the paginated envelope only; the legacy bare array always lists every key. */
+                /**
+                 * @description Send `false` to leave revoked keys out (the console's default view). Expired keys are still listed: they show what needs replacing. The deprecated bare array ignores it.
+                 * @example true
+                 */
                 include_revoked?: "true" | "false";
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /**
-             * @description Two shapes, selected by the request — see `oneOf`.
-             *
-             *     - **`?limit=` or `?cursor=` present** → the standard `{data, pagination}` envelope with `next_cursor` + `has_more`. Use this; it is the only shape that pages.
-             *     - **neither present** → the legacy bare JSON array of every PAK in the workspace (capped at 1000). DEPRECATED as of 2026-09 and retained only so `@productcraft/platform-auth` <= 0.0.12 clients, which cannot send either query param, keep working. It will be removed once those clients are off it; new integrations must send `?limit=`.
-             */
+            /** @description One page of keys. */
             200: {
                 headers: {
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ListPlatformApiKeysResponseDto"] | components["schemas"]["PublicApiKeyDto"][];
+                    "application/json": components["schemas"]["ListPlatformApiKeysResponseDto"];
                 };
             };
             /** @description Malformed `cursor`, or `include_revoked` is not `true` or `false` (`VALIDATION_ERROR`). */
@@ -5558,13 +6661,32 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_create: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that deduplicates retries for 24 h. A retry with the same key and body mints nothing and answers `409 PAK_ALREADY_MINTED` with the first key's `id` in `details` (the token is shown once and never cached; rotate the key for a new one). The SDKs send one on every create. */
+                "Idempotency-Key"?: string;
+            };
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5577,6 +6699,8 @@ interface operations {
         responses: {
             201: {
                 headers: {
+                    /** @description `true` when this response is a replay of an earlier request with the same `Idempotency-Key`. */
+                    "Idempotent-Replay"?: "true";
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -5624,6 +6748,30 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description `PAK_ALREADY_MINTED`: this `Idempotency-Key` already minted a key (its `id` is in `details`); the token was shown once, so rotate that key for a new one. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key). */
+            409: {
+                headers: {
+                    /** @description Seconds to wait before retrying with the same key (sent with `IDEMPOTENCY_IN_PROGRESS`). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_presets: {
@@ -5631,6 +6779,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5676,6 +6828,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_preview: {
@@ -5683,6 +6847,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -5742,6 +6910,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_get: {
@@ -5749,7 +6929,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the api key.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -5805,17 +6993,40 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_revoke: {
         parameters: {
             query?: {
-                /** @description When `true`, publish a `pak:revoked` Redis fan-out so subscribed services evict their caches immediately instead of waiting out the 60s TTL. */
+                /**
+                 * @description When `true`, publish a `pak:revoked` Redis fan-out so subscribed services evict their caches immediately instead of waiting out the 60s TTL.
+                 * @example true
+                 */
                 force?: boolean;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the api key.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -5870,6 +7081,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_update: {
@@ -5877,7 +7100,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the api key.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -5947,6 +7178,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_setBindings: {
@@ -5954,7 +7197,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the api key.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -6025,6 +7276,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     PlatformApiKeyController_rotate: {
@@ -6032,7 +7295,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the api key.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 id: string;
             };
             cookie?: never;
@@ -6092,30 +7363,70 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceAuditFeedController_listFeed: {
         parameters: {
             query?: {
-                /** @description ISO-8601 inclusive lower bound on `timestamp`. Items older than `since` are not returned. */
+                /**
+                 * @description ISO-8601 inclusive lower bound on `timestamp`. Items older than `since` are not returned.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 since?: string;
-                /** @description ISO-8601 inclusive upper bound on `timestamp`. Composes with `since`, `action`, `actor_id` and with the cursor. A bare date resolves to midnight UTC, so `until=2026-05-01` excludes that day’s later entries. */
+                /**
+                 * @description ISO-8601 inclusive upper bound on `timestamp`. Composes with `since`, `action`, `actor_id` and with the cursor. A bare date resolves to midnight UTC, so `until=2026-05-01` excludes that day’s later entries.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 until?: string;
-                /** @description Exact-match filter on the action identifier (e.g. `workspace.member.removed`). A partial string matches nothing. Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows. */
+                /**
+                 * @description Exact-match filter on the action identifier (e.g. `workspace.member.removed`). A partial string matches nothing. Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows.
+                 * @example workspace.member.removed
+                 */
                 action?: string;
-                /** @description Exact-match filter on the acting account UUID. Must be a well-formed UUID — anything else is a 400, not an empty page. System rows have a null actor and are excluded by this filter. */
+                /**
+                 * @description Exact-match filter on the acting account UUID. Must be a well-formed UUID — anything else is a 400, not an empty page. System rows have a null actor and are excluded by this filter.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 actor_id?: string;
-                /** @description When `true`, return only admin changes: reads (any action ending `.read`), successful sign-ins (`auth.signin.succeeded`) and MCP tool-call rows (`workspace.mcp_tool.*`) are left out. The same rows the dashboard stats count as admin changes. Composes with every other filter and with the cursor; pass it on every page. Any value other than `true` or `1` means `false`. */
+                /**
+                 * @description When `true`, return only admin changes: reads (any action ending `.read`), successful sign-ins (`auth.signin.succeeded`) and MCP tool-call rows (`workspace.mcp_tool.*`) are left out. The same rows the dashboard stats count as admin changes. Composes with every other filter and with the cursor; pass it on every page. Any value other than `true` or `1` means `false`.
+                 * @example false
+                 */
                 changes_only?: boolean;
-                /** @description Opaque cursor from a previous response's `pagination.next_cursor`. Resumes the feed at the same merge boundary. */
+                /**
+                 * @description Opaque cursor from a previous response's `pagination.next_cursor`. Resumes the feed at the same merge boundary.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
-                /** @description Per-page cap. Clamped to 1..500; default 100. */
+                /**
+                 * @description Per-page cap. Clamped to 1..500; default 100.
+                 * @example 100
+                 */
                 limit?: number;
-                /** @description Comma-separated subset of sources to include (e.g. `workspace_audit,heimdall_audit`). Omitted = all enabled sources. */
+                /**
+                 * @description Comma-separated subset of sources to include (e.g. `workspace_audit,heimdall_audit`). Omitted = all enabled sources.
+                 * @example workspace_audit,heimdall_audit
+                 */
                 sources?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6171,26 +7482,60 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceAuditController_listAuditLogs: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
-                /** @description Exact-match filter on the action identifier (e.g. `workspace.member.removed`). Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows. */
+                /**
+                 * @description Exact-match filter on the action identifier (e.g. `workspace.member.removed`). Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows.
+                 * @example workspace.member.removed
+                 */
                 action?: string;
-                /** @description Exact-match filter on the acting account UUID. System rows have a null actor and are excluded by this filter. */
+                /**
+                 * @description Exact-match filter on the acting account UUID. System rows have a null actor and are excluded by this filter.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 actor_id?: string;
-                /** @description Inclusive lower bound on `created_at`. ISO-8601 date (`2026-05-01`, midnight UTC) or date-time (`2026-05-01T09:00:00Z`). Composes with `action` / `actor_id` / `until` and with the cursor. */
+                /**
+                 * @description Inclusive lower bound on `created_at`. ISO-8601 date (`2026-05-01`, midnight UTC) or date-time (`2026-05-01T09:00:00Z`). Composes with `action` / `actor_id` / `until` and with the cursor.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 since?: string;
-                /** @description Inclusive upper bound on `created_at`. Same formats as `since`. Note a bare date resolves to midnight UTC, so `until=2026-05-01` excludes that day’s later entries. */
+                /**
+                 * @description Inclusive upper bound on `created_at`. Same formats as `since`. Note a bare date resolves to midnight UTC, so `until=2026-05-01` excludes that day’s later entries.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 until?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6227,21 +7572,55 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceAuditController_exportAuditLogs: {
         parameters: {
             query?: {
-                /** @description Defaults to `ndjson`. */
+                /**
+                 * @description Defaults to `ndjson`.
+                 * @example ndjson
+                 */
                 format?: "ndjson" | "csv";
-                /** @description Exact-match filter on the action identifier, same rules as the list. Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows. */
+                /**
+                 * @description Exact-match filter on the action identifier, same rules as the list. Mail, Waitlist, Social and Auth actions are reported under the product name (`mail.domain.verified`); the older internal spellings (`envoi.*`, `rally.*`, `agora.*`, `heimdall.*`) are still accepted here and match the same rows.
+                 * @example workspace.member.removed
+                 */
                 action?: string;
+                /**
+                 * @description Exact-match filter on the acting account UUID, same rules as the list.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 actor_id?: string;
+                /**
+                 * @description Inclusive lower bound on `created_at`, same formats as the list.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 since?: string;
+                /**
+                 * @description Inclusive upper bound on `created_at`, same formats as the list.
+                 * @example 2026-11-01T00:00:00Z
+                 */
                 until?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6309,6 +7688,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_setAvatar: {
@@ -6316,6 +7707,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6361,6 +7756,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_removeAvatar: {
@@ -6368,6 +7775,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6412,18 +7823,40 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_listInvites: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6479,13 +7912,32 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_createInvite: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that deduplicates retries for 24 h. A retry with the same key and body returns the first response with `Idempotent-Replay: true` instead of creating a second resource. The SDKs send one on every create. */
+                "Idempotency-Key"?: string;
+            };
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6498,6 +7950,8 @@ interface operations {
         responses: {
             201: {
                 headers: {
+                    /** @description `true` when this response is a replay of an earlier request with the same `Idempotency-Key`. */
+                    "Idempotent-Replay"?: "true";
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -6545,6 +7999,30 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key). */
+            409: {
+                headers: {
+                    /** @description Seconds to wait before retrying with the same key (sent with `IDEMPOTENCY_IN_PROGRESS`). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_revokeInvite: {
@@ -6552,7 +8030,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the invite.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 invite_id: string;
             };
             cookie?: never;
@@ -6597,22 +8083,50 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_listMembers: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
-                /** @description Case-insensitive substring matched against the member’s display name, username OR primary email. `%` and `_` are matched literally. */
+                /**
+                 * @description Case-insensitive substring matched against the member’s display name, username OR primary email. `%` and `_` are matched literally.
+                 * @example ada
+                 */
                 q?: string;
-                /** @description Exact role name the membership is bound to — `owner`, `admin`, `member`, or a custom role’s name. Composes with `q` and with the cursor. */
+                /**
+                 * @description Exact role name the membership is bound to — `owner`, `admin`, `member`, or a custom role’s name. Composes with `q` and with the cursor.
+                 * @example admin
+                 */
                 role?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6668,6 +8182,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_removeMember: {
@@ -6675,7 +8201,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the account.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 account_id: string;
             };
             cookie?: never;
@@ -6730,6 +8264,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceController_updateMemberRole: {
@@ -6737,7 +8283,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the account.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 account_id: string;
             };
             cookie?: never;
@@ -6807,18 +8361,40 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspacePolicyController_list: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6855,13 +8431,32 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspacePolicyController_create: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that deduplicates retries for 24 h. A retry with the same key and body returns the first response with `Idempotent-Replay: true` instead of creating a second resource. The SDKs send one on every create. */
+                "Idempotency-Key"?: string;
+            };
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6875,6 +8470,8 @@ interface operations {
             /** @description Policy created. */
             201: {
                 headers: {
+                    /** @description `true` when this response is a replay of an earlier request with the same `Idempotency-Key`. */
+                    "Idempotent-Replay"?: "true";
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -6912,9 +8509,23 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Name already in use, or the workspace already has 100 policies. */
+            /** @description Name already in use, or the workspace already has 100 policies. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key). */
             409: {
                 headers: {
+                    /** @description Seconds to wait before retrying with the same key (sent with `IDEMPOTENCY_IN_PROGRESS`). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -6929,6 +8540,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -6974,6 +8589,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspacePolicyController_get: {
@@ -6981,7 +8608,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the policy.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 policy_id: string;
             };
             cookie?: never;
@@ -7018,6 +8653,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspacePolicyController_delete: {
@@ -7025,7 +8672,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the policy.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 policy_id: string;
             };
             cookie?: never;
@@ -7072,6 +8727,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspacePolicyController_update: {
@@ -7079,7 +8746,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the policy.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 policy_id: string;
             };
             cookie?: never;
@@ -7150,18 +8825,40 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceRoleController_list: {
         parameters: {
             query?: {
-                /** @description Page size. Defaults to 20, clamped to 100. */
-                limit?: string;
-                /** @description Opaque `next_cursor` from the previous page. */
+                /**
+                 * @description Page size. Defaults to 20, clamped to 100.
+                 * @example 20
+                 */
+                limit?: number;
+                /**
+                 * @description Opaque `next_cursor` from the previous page.
+                 * @example eyJjcmVhdGVkX2F0IjoiMjAyNi0xMS0wMVQwMDowMDowMFoifQ
+                 */
                 cursor?: string;
             };
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -7198,13 +8895,32 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceRoleController_create: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that deduplicates retries for 24 h. A retry with the same key and body returns the first response with `Idempotent-Replay: true` instead of creating a second resource. The SDKs send one on every create. */
+                "Idempotency-Key"?: string;
+            };
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -7217,6 +8933,8 @@ interface operations {
         responses: {
             201: {
                 headers: {
+                    /** @description `true` when this response is a replay of an earlier request with the same `Idempotency-Key`. */
+                    "Idempotent-Replay"?: "true";
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -7264,9 +8982,23 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Role name already in use or reserved for a system role (`ROLE_NAME_TAKEN`). */
+            /** @description Role name already in use or reserved for a system role (`ROLE_NAME_TAKEN`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key). */
             409: {
                 headers: {
+                    /** @description Seconds to wait before retrying with the same key (sent with `IDEMPOTENCY_IN_PROGRESS`). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
                     "X-Request-Id": components["headers"]["RequestId"];
                     [name: string]: unknown;
                 };
@@ -7281,7 +9013,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the role.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 role_id: string;
             };
             cookie?: never;
@@ -7337,6 +9077,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceRoleController_delete: {
@@ -7344,7 +9096,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the role.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 role_id: string;
             };
             cookie?: never;
@@ -7409,6 +9169,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceRoleController_update: {
@@ -7416,7 +9188,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description Id of the role.
+                 * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+                 */
                 role_id: string;
             };
             cookie?: never;
@@ -7486,6 +9266,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceServiceController_list: {
@@ -7493,6 +9285,10 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
             };
             cookie?: never;
@@ -7538,6 +9334,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceServiceController_enable: {
@@ -7545,7 +9353,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+                 * @example mail
+                 */
                 service: string;
             };
             cookie?: never;
@@ -7605,6 +9421,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceServiceController_disable: {
@@ -7612,7 +9440,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+                 * @example mail
+                 */
                 service: string;
             };
             cookie?: never;
@@ -7677,6 +9513,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WorkspaceServiceController_updateSettings: {
@@ -7684,7 +9532,15 @@ interface operations {
             query?: never;
             header?: never;
             path: {
+                /**
+                 * @description Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+                 * @example acme
+                 */
                 workspace_slug: string;
+                /**
+                 * @description The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+                 * @example mail
+                 */
                 service: string;
             };
             cookie?: never;
@@ -7747,6 +9603,18 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before retrying (the window, 60). */
+                    "Retry-After"?: number;
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
 }