@pulumi/auth0 3.50.0-alpha.1785561432 → 3.50.0

package/types/output.d.ts

@@ -612,6 +612,30 @@ export interface BrandingThemeFontsTitle {
      */
     size?: number;
 }
+export interface BrandingThemeIdentifiers {
+    /**
+     * Login display style. Available options: `unified`, `separate`.
+     */
+    loginDisplay: string;
+    /**
+     * Whether OTP autocomplete is enabled.
+     */
+    otpAutocomplete: boolean;
+    /**
+     * Phone number display settings.
+     */
+    phoneDisplay: outputs.BrandingThemeIdentifiersPhoneDisplay;
+}
+export interface BrandingThemeIdentifiersPhoneDisplay {
+    /**
+     * Phone number formatting. Available options: `international`, `regional`.
+     */
+    formatting: string;
+    /**
+     * Phone number masking. Available options: `maskDigits`, `hideCountryCode`, `showAll`.
+     */
+    masking: string;
+}
 export interface BrandingThemePageBackground {
     /**
      * Background color. Defaults to `#000000`.
@@ -1520,6 +1544,12 @@ export interface ClientFedcmLoginGoogle {
      */
     isEnabled: boolean;
 }
+export interface ClientIdentityAssertionAuthorizationGrant {
+    /**
+     * Whether the client can exchange ID-JAGs for access tokens. (EA only)
+     */
+    active: boolean;
+}
 export interface ClientJwtConfiguration {
     /**
      * Algorithm used to sign JWTs. Can be one of `HS256`, `RS256`, `PS256`.
@@ -1679,7 +1709,7 @@ export interface ClientSessionTransfer {
      */
     canCreateSessionTransferToken: boolean;
     /**
-     * Configuration for delegation (impersonation) access using Session Transfer Tokens. (EA Only)
+     * Configuration for delegation (impersonation) access using Session Transfer Tokens.
      */
     delegation?: outputs.ClientSessionTransferDelegation;
     /**
@@ -1697,11 +1727,11 @@ export interface ClientSessionTransfer {
 }
 export interface ClientSessionTransferDelegation {
     /**
-     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`. (EA Only)
+     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`.
      */
     allowDelegatedAccess: boolean;
     /**
-     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`. (EA Only)
+     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`.
      */
     enforceDeviceBinding: string;
 }
@@ -1737,6 +1767,15 @@ export interface ConnectionAuthentication {
 export interface ConnectionConnectedAccounts {
     active: boolean;
 }
+export interface ConnectionCrossAppAccessRequestingApp {
+    active: boolean;
+}
+export interface ConnectionCrossAppAccessResourceApp {
+    /**
+     * Whether the connection acts as a Cross App Access resource application. One of `enabled` or `disabled`. (EA only)
+     */
+    status: string;
+}
 export interface ConnectionDirectoryMapping {
     /**
      * The field location in the Auth0 schema.
@@ -2014,6 +2053,10 @@ export interface ConnectionOptions {
      * If there are user fields that should not be stored in Auth0 databases due to privacy reasons, you can add them to the DenyList here.
      */
     nonPersistentAttrs: string[];
+    /**
+     * Additional OIDC metadata to include in the discovery document. Only applicable when strategy=oidc, okta, or samlp. (EA only)
+     */
+    oidcMetadata: string;
     /**
      * Defines options for the passkey authentication method
      */
@@ -3808,6 +3851,30 @@ export interface GetBrandingThemeFontTitle {
      */
     size: number;
 }
+export interface GetBrandingThemeIdentifier {
+    /**
+     * Login display style. Available options: `unified`, `separate`.
+     */
+    loginDisplay: string;
+    /**
+     * Whether OTP autocomplete is enabled.
+     */
+    otpAutocomplete: boolean;
+    /**
+     * Phone number display settings.
+     */
+    phoneDisplays: outputs.GetBrandingThemeIdentifierPhoneDisplay[];
+}
+export interface GetBrandingThemeIdentifierPhoneDisplay {
+    /**
+     * Phone number formatting. Available options: `international`, `regional`.
+     */
+    formatting: string;
+    /**
+     * Phone number masking. Available options: `maskDigits`, `hideCountryCode`, `showAll`.
+     */
+    masking: string;
+}
 export interface GetBrandingThemePageBackground {
     /**
      * Background color. Defaults to `#000000`.
@@ -4596,6 +4663,12 @@ export interface GetClientGrantsClientGrant {
      */
     subjectType: string;
 }
+export interface GetClientIdentityAssertionAuthorizationGrant {
+    /**
+     * Whether the client can exchange ID-JAGs for access tokens. (EA only)
+     */
+    active: boolean;
+}
 export interface GetClientJwtConfiguration {
     /**
      * Algorithm used to sign JWTs. Can be one of `HS256`, `RS256`, `PS256`.
@@ -4755,7 +4828,7 @@ export interface GetClientSessionTransfer {
      */
     canCreateSessionTransferToken: boolean;
     /**
-     * Configuration for delegation (impersonation) access using Session Transfer Tokens. (EA Only)
+     * Configuration for delegation (impersonation) access using Session Transfer Tokens.
      */
     delegations: outputs.GetClientSessionTransferDelegation[];
     /**
@@ -4773,11 +4846,11 @@ export interface GetClientSessionTransfer {
 }
 export interface GetClientSessionTransferDelegation {
     /**
-     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`. (EA Only)
+     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`.
      */
     allowDelegatedAccess: boolean;
     /**
-     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`. (EA Only)
+     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`.
      */
     enforceDeviceBinding: string;
 }
@@ -4887,7 +4960,7 @@ export interface GetClientsClient {
         [key: string]: string;
     };
     /**
-     * Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string.
+     * Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string. Set `hideClientSecret` to `true` to avoid persisting this value into Terraform state.
      */
     clientSecret: string;
     /**
@@ -4918,6 +4991,10 @@ export interface GetClientsClient {
      * Types of grants that this client is authorized to use.
      */
     grantTypes: string[];
+    /**
+     * Configures the client to participate in the Identity Assertion Authorization Grant (ID-JAG) exchange, used for Cross App Access (XAA). (EA only)
+     */
+    identityAssertionAuthorizationGrants: outputs.GetClientsClientIdentityAssertionAuthorizationGrant[];
     /**
      * Indicates whether this client is a first-party client.
      */
@@ -5032,6 +5109,12 @@ export interface GetClientsClientFedcmLoginGoogle {
      */
     isEnabled: boolean;
 }
+export interface GetClientsClientIdentityAssertionAuthorizationGrant {
+    /**
+     * Whether the client can exchange ID-JAGs for access tokens. (EA only)
+     */
+    active: boolean;
+}
 export interface GetClientsClientMyOrganizationConfiguration {
     /**
      * The list of connection strategies that are allowed when creating organizations for this client (e.g. "okta", "samlp").
@@ -5095,7 +5178,7 @@ export interface GetClientsClientSessionTransfer {
      */
     canCreateSessionTransferToken: boolean;
     /**
-     * Configuration for delegation (impersonation) access using Session Transfer Tokens. (EA Only)
+     * Configuration for delegation (impersonation) access using Session Transfer Tokens.
      */
     delegations: outputs.GetClientsClientSessionTransferDelegation[];
     /**
@@ -5113,11 +5196,11 @@ export interface GetClientsClientSessionTransfer {
 }
 export interface GetClientsClientSessionTransferDelegation {
     /**
-     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`. (EA Only)
+     * Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Defaults to `false`.
      */
     allowDelegatedAccess: boolean;
     /**
-     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`. (EA Only)
+     * Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Defaults to `ip`.
      */
     enforceDeviceBinding: string;
 }
@@ -5153,6 +5236,15 @@ export interface GetConnectionAuthentication {
 export interface GetConnectionConnectedAccount {
     active: boolean;
 }
+export interface GetConnectionCrossAppAccessRequestingApp {
+    active: boolean;
+}
+export interface GetConnectionCrossAppAccessResourceApp {
+    /**
+     * Whether the connection acts as a Cross App Access resource application. One of `enabled` or `disabled`. (EA only)
+     */
+    status: string;
+}
 export interface GetConnectionDirectoryDefaultMappingMapping {
     /**
      * The field location in the Auth0 schema.
@@ -5497,6 +5589,10 @@ export interface GetConnectionOption {
      * If there are user fields that should not be stored in Auth0 databases due to privacy reasons, you can add them to the DenyList here.
      */
     nonPersistentAttrs: string[];
+    /**
+     * Additional OIDC metadata to include in the discovery document. Only applicable when strategy=oidc, okta, or samlp. (EA only)
+     */
+    oidcMetadata: string;
     /**
      * Defines options for the passkey authentication method
      */
@@ -6569,6 +6665,10 @@ export interface GetNetworkAclRuleMatch {
      * ASNs. Must contain between 1 and 10 unique items.
      */
     asns: number[];
+    /**
+     * Auth0-curated blocklists to match against. Allowed values are `auth0.low_reputation` and `auth0.icloud_relay_proxy`; the set is validated by the Management API and may grow. Requires the `advanced-breached-password-detection` entitlement and the `tenantAclCuratedBlocklists` feature flag to be enabled on the tenant. (EA Only)
+     */
+    auth0Manageds: string[];
     /**
      * Connecting IPv4 CIDRs. Must contain between 1 and 20 unique items. Can be IPv4 addresses or CIDR blocks.
      */
@@ -6615,6 +6715,10 @@ export interface GetNetworkAclRuleNotMatch {
      * ASNs. Must contain between 1 and 10 unique items.
      */
     asns: number[];
+    /**
+     * Auth0-curated blocklists to match against. Allowed values are `auth0.low_reputation` and `auth0.icloud_relay_proxy`; the set is validated by the Management API and may grow. Requires the `advanced-breached-password-detection` entitlement and the `tenantAclCuratedBlocklists` feature flag to be enabled on the tenant. (EA Only)
+     */
+    auth0Manageds: string[];
     /**
      * Connecting IPv4 CIDRs. Must contain between 1 and 20 unique items. Can be IPv4 addresses or CIDR blocks.
      */
@@ -7135,6 +7239,16 @@ export interface GetSigningKeysSigningKey {
      */
     thumbprint: string;
 }
+export interface GetTenantCountryCode {
+    /**
+     * List of ISO 3166-1 alpha-2 country codes.
+     */
+    lists: string[];
+    /**
+     * Whether the list is an allow-list or deny-list. Available options: `allow`, `deny`.
+     */
+    mode: string;
+}
 export interface GetTenantDefaultTokenQuota {
     /**
      * The token quota configuration.
@@ -7846,6 +7960,10 @@ export interface NetworkAclRuleMatch {
      * ASNs. Must contain between 1 and 10 unique items.
      */
     asns?: number[];
+    /**
+     * Auth0-curated blocklists to match against. Allowed values are `auth0.low_reputation` and `auth0.icloud_relay_proxy`; the set is validated by the Management API and may grow. Requires the `advanced-breached-password-detection` entitlement and the `tenantAclCuratedBlocklists` feature flag to be enabled on the tenant. (EA Only)
+     */
+    auth0Manageds?: string[];
     /**
      * Connecting IPv4 CIDRs. Must contain between 1 and 20 unique items. Can be IPv4 addresses or CIDR blocks.
      */
@@ -7892,6 +8010,10 @@ export interface NetworkAclRuleNotMatch {
      * ASNs. Must contain between 1 and 10 unique items.
      */
     asns?: number[];
+    /**
+     * Auth0-curated blocklists to match against. Allowed values are `auth0.low_reputation` and `auth0.icloud_relay_proxy`; the set is validated by the Management API and may grow. Requires the `advanced-breached-password-detection` entitlement and the `tenantAclCuratedBlocklists` feature flag to be enabled on the tenant. (EA Only)
+     */
+    auth0Manageds?: string[];
     /**
      * Connecting IPv4 CIDRs. Must contain between 1 and 20 unique items. Can be IPv4 addresses or CIDR blocks.
      */
@@ -8358,6 +8480,16 @@ export interface SelfServiceProfileUserAttribute {
      */
     name: string;
 }
+export interface TenantCountryCodes {
+    /**
+     * List of ISO 3166-1 alpha-2 country codes.
+     */
+    lists: string[];
+    /**
+     * Whether the list is an allow-list or deny-list. Available options: `allow`, `deny`.
+     */
+    mode: string;
+}
 export interface TenantDefaultTokenQuota {
     /**
      * The token quota configuration.