@rebilly/api 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,3 +1,3 @@
-## 0.8.0 (2026-10-26)
+## 0.9.0 (2026-10-26)
 
 This was a version bump only for rebilly-api to align it with other projects, there were no code changes.

package/dist/core-client.d.ts

@@ -10361,7 +10361,7 @@ export type PostRoleVariables = {
 };
 export type GetSecuritySettingsResult = SecuritySettings;
 export type PutSecuritySettingsResult = SecuritySettings;
-export type PutSecuritySettingsBody = Omit<SecuritySettings, "mfaAdoption">;
+export type PutSecuritySettingsBody = Omit<SecuritySettings, "currentIpAddress" | "mfaAdoption">;
 export type PutSecuritySettingsResponseHeaders = {
     rateLimitLimit?: number;
     rateLimitRemaining?: number;

package/dist/core-client.schemas.d.ts

@@ -497,6 +497,13 @@ export type Unauthorized = unknown & {
      */
     status?: number;
 } & BaseProblem;
+/**
+ * Unique organization identifier.
+ * An organization is an entity that represents a company.
+ * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+ * @maxLength 50
+ */
+export type OrganizationId = string;
 export type Forbidden = unknown & {
     /**
      * HTTP status code.
@@ -509,8 +516,15 @@ export type Forbidden = unknown & {
      * Most responses use a descriptive message, such as `Not allowed to change security settings`.
      * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
      * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+     * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
      */
     error?: string;
+    /**
+     * ID of the organization that does not allow the IP address of the request.
+     * This property is present only if `error` is `ip_not_allowed`.
+     * The organization is the organization of the request or another organization that the request acts on.
+     */
+    organizationId?: OrganizationId;
 } & BaseProblem;
 export type NotFound = {
     /**
@@ -2072,13 +2086,6 @@ export type CustomerLifetimeRevenue = {
      */
     amountUsd?: number;
 };
-/**
- * Unique organization identifier.
- * An organization is an entity that represents a company.
- * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
- * @maxLength 50
- */
-export type OrganizationId = string;
 export type TaxNumber = {
     /**
      * Type of the tax number.
@@ -15196,8 +15203,14 @@ export type ApiKey = {
      */
     type?: "secret" | "publishable";
     /**
-     * Specify access control list here if creating a restricted API key.
-     * Send all matching permission with an empty scope to allow all permissions.
+     * Permissions for this API key.
+     *
+     * A request is authorized only when these permissions include the permission for the operation,
+     * and the associated user has that permission.
+     * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+     * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+     * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+     * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
      */
     acl?: Acl;
     allowedIps?: AllowedIps;
@@ -25419,6 +25432,22 @@ export type SecuritySettings = {
      * Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI.
      */
     requireMfa: boolean;
+    /**
+     * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+     * This setting does not apply to API keys.
+     * This setting applies to the current environment only: live and sandbox are configured separately.
+     * If an IP address has no prefix length, only that address is allowed.
+     * Wildcards, such as `198.51.*.*`, are not accepted.
+     * To remove the restriction, set this value to `null` or an empty array.
+     * To retain the current list, omit this property.
+     */
+    allowedIps?: AllowedIps;
+    /**
+     * IP address of the client that sent the request.
+     * This value is `null` if the IP address of the client cannot be determined.
+     * @format ip
+     */
+    readonly currentIpAddress?: string | null;
     /**
      * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
      * Pending invitations are counted as users without MFA.

package/dist/storefront-client.schemas.d.ts

@@ -428,6 +428,13 @@ export type Unauthorized = unknown & {
      */
     status?: number;
 } & BaseProblem;
+/**
+ * Unique organization identifier.
+ * An organization is an entity that represents a company.
+ * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+ * @maxLength 50
+ */
+export type OrganizationId = string;
 export type Forbidden = unknown & {
     /**
      * HTTP status code.
@@ -440,8 +447,15 @@ export type Forbidden = unknown & {
      * Most responses use a descriptive message, such as `Not allowed to change security settings`.
      * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
      * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+     * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
      */
     error?: string;
+    /**
+     * ID of the organization that does not allow the IP address of the request.
+     * This property is present only if `error` is `ip_not_allowed`.
+     * The organization is the organization of the request or another organization that the request acts on.
+     */
+    organizationId?: OrganizationId;
 } & BaseProblem;
 /**
  * Invalid field details.
@@ -7349,13 +7363,6 @@ export type PostSubscription = {
      */
     deliveryAddress?: ContactObject | null;
 };
-/**
- * Unique organization identifier.
- * An organization is an entity that represents a company.
- * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
- * @maxLength 50
- */
-export type OrganizationId = string;
 export type Website = {
     readonly id?: WebsiteId;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebilly/api",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Rebilly Core and Storefront API clients generated from the OpenAPI definitions",
   "type": "module",
   "sideEffects": false,