@sendmux/management 1.3.0 → 1.4.0

package/README.md

@@ -14,7 +14,7 @@ Generated TypeScript client for the Sendmux Management API.
 
 ## Requirements
 
-- A root Sendmux API key with the `smx_root_*` prefix.
+- A root Sendmux API key with the `smx_root_*` prefix; alternatively, a REST OAuth grant for this surface.
 - A JavaScript runtime with the standard Fetch API.
 
 ## Installation
@@ -23,6 +23,20 @@ Generated TypeScript client for the Sendmux Management API.
 npm install @sendmux/management
 ```
 
+## OAuth access tokens
+
+Pass `accessToken` instead of `apiKey` for a REST OAuth token or synchronous/asynchronous provider.
+
+```ts
+import { createManagementClient } from "@sendmux/management";
+
+const client = createManagementClient({
+  accessToken: () => process.env.SENDMUX_ACCESS_TOKEN!,
+});
+```
+
+The provider runs before each request. Your application owns token storage and refresh; required scopes still apply. See [OAuth setup](https://sendmux.ai/docs/developer-tools/oauth).
+
 ## Usage
 
 ```ts
@@ -64,7 +78,7 @@ const client = createManagementClient({
 const domain = await managementGetDomain({
   client,
   path: { public_id: "mdom_123" },
-  headers: conditionalHeaders({ ifNoneMatch: 'W/"etag"' }),
+  headers: { ...conditionalHeaders({ ifNoneMatch: 'W/"etag"' }) },
 });
 
 console.log(domain.data);

package/dist/generated/client/utils.gen.js

@@ -81,7 +81,7 @@ export const getParseAs = (contentType) => {
 };
 const checkForExistence = (options, name) => {
     if (!name) {
-        return false;
+        return options.headers.has('Authorization');
     }
     if (options.headers.has(name) ||
         options.query?.[name] ||

package/dist/generated/sdk.gen.js

@@ -6,7 +6,7 @@ import { client } from './client.gen.js';
  * Returns the current spendable balance.
  */
 export const managementListBalance = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/billing/balance',
     ...options
 });
@@ -16,7 +16,7 @@ export const managementListBalance = (options) => (options?.client ?? client).ge
  * Returns a spend summary over a configurable lookback period.
  */
 export const managementGetSpendSummary = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/billing/summary',
     ...options
 });
@@ -26,7 +26,7 @@ export const managementGetSpendSummary = (options) => (options?.client ?? client
  * Returns paginated credit transaction history with optional type filter. Uses cursor-based pagination ordered by created_at descending — pass `cursor=<next_cursor>` from the previous response to fetch the next page.
  */
 export const managementListTransactions = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/billing/transactions',
     ...options
 });
@@ -36,7 +36,7 @@ export const managementListTransactions = (options) => (options?.client ?? clien
  * Returns a cursor-paginated list of sending domains configured for the team, ordered by `created_at` descending. Each entry includes the DNS records the customer must place, the current verification status, and the SES DKIM state. Pass `cursor=<next_cursor>` from the previous response to fetch the next page.
  */
 export const managementListDomains = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains',
     ...options
 });
@@ -48,7 +48,7 @@ export const managementListDomains = (options) => (options?.client ?? client).ge
  * Supply an `Idempotency-Key` header (any unique string, max 255 chars) to safely retry on network errors. Replays with the same key return the original response; replays with a different body return `409 idempotency_conflict`.
  */
 export const managementCreateDomain = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains',
     ...options,
     headers: {
@@ -62,7 +62,7 @@ export const managementCreateDomain = (options) => (options?.client ?? client).p
  * Removes a domain from our mail platform, Amazon SES, and Sendmux. Blocked if any active mailbox still uses the domain — delete those mailboxes first.
  */
 export const managementDeleteDomain = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}',
     ...options
 });
@@ -72,7 +72,7 @@ export const managementDeleteDomain = (options) => (options.client ?? client).de
  * Returns a single domain including its DNS records and latest verification state. Responses carry a weak `ETag` header — send it back as `If-None-Match` on the next request and the server will return `304 Not Modified` (no body) when the resource has not changed.
  */
 export const managementGetDomain = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}',
     ...options
 });
@@ -82,7 +82,7 @@ export const managementGetDomain = (options) => (options.client ?? client).get({
  * Upgrades a send-only domain to sending and receiving. Downgrades are rejected. After upgrade, the domain returns to `pending` until the required MX record verifies.
  */
 export const managementUpdateDomain = (options) => (options.client ?? client).patch({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}',
     ...options,
     headers: {
@@ -98,7 +98,7 @@ export const managementUpdateDomain = (options) => (options.client ?? client).pa
  * Responses carry a weak `ETag` — send it as `If-None-Match` to skip the body when the filter set has not changed (returns `304 Not Modified`). The same ETag is the value to use in `If-Match` on the corresponding PUT for optimistic concurrency.
  */
 export const managementGetDomainFilters = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}/filters',
     ...options
 });
@@ -110,7 +110,7 @@ export const managementGetDomainFilters = (options) => (options.client ?? client
  * For optimistic concurrency, send `If-Match: <etag>` using the ETag from a prior GET. A mismatched `If-Match` returns `409 conflict` (the server's ETag is echoed back so you can decide whether to re-fetch). Responses carry the new ETag so chained edits can pipeline without a re-GET.
  */
 export const managementSetDomainFilters = (options) => (options.client ?? client).put({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}/filters',
     ...options,
     headers: {
@@ -124,7 +124,7 @@ export const managementSetDomainFilters = (options) => (options.client ?? client
  * Checks the domain's published DNS records and latest Amazon SES DKIM and MAIL FROM statuses. If every required check passes, the domain is marked verified. A previously failed domain remains failed until a complete check succeeds. Domains automatically re-verify every 6 hours — this endpoint is only needed to trigger a check on demand.
  */
 export const managementVerifyDomain = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}/verify',
     ...options
 });
@@ -134,7 +134,7 @@ export const managementVerifyDomain = (options) => (options.client ?? client).po
  * Returns the domain's DNS records formatted as a BIND-style zone file fragment. Suitable for direct paste into a DNS provider that accepts zone-file imports.
  */
 export const managementGetDomainZoneFile = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/domains/{public_id}/zone-file',
     ...options
 });
@@ -144,7 +144,7 @@ export const managementGetDomainZoneFile = (options) => (options.client ?? clien
  * Returns paginated delivery logs with cursor-based pagination and filters.
  */
 export const managementListEmailLogs = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/emails/logs',
     ...options
 });
@@ -154,7 +154,7 @@ export const managementListEmailLogs = (options) => (options?.client ?? client).
  * Returns a single delivery log by its public ID. Responses carry a weak `ETag` header — send it back as `If-None-Match` on the next request and the server will return `304 Not Modified` (no body) when the log has not changed. Logs in a terminal status (sent/failed/rejected) stop changing, so 304 replay is a real bandwidth win on repeated polls.
  */
 export const managementGetEmailLog = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/emails/logs/{public_id}',
     ...options
 });
@@ -164,7 +164,7 @@ export const managementGetEmailLog = (options) => (options.client ?? client).get
  * Returns aggregated email delivery counts with flexible time windowing and comparison period.
  */
 export const managementGetEmailMetrics = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/emails/metrics',
     ...options
 });
@@ -174,7 +174,7 @@ export const managementGetEmailMetrics = (options) => (options?.client ?? client
  * Returns paginated incoming message logs for billing accountability.
  */
 export const managementListInboxLogs = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/inboxes/logs',
     ...options
 });
@@ -184,7 +184,7 @@ export const managementListInboxLogs = (options) => (options?.client ?? client).
  * Returns one incoming message log by public ID.
  */
 export const managementGetInboxLog = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/inboxes/logs/{public_id}',
     ...options
 });
@@ -194,7 +194,7 @@ export const managementGetInboxLog = (options) => (options.client ?? client).get
  * Returns a cursor-paginated list of mailboxes configured for the team, ordered by `created_at` descending. Pass `cursor=<next_cursor>` from the previous response to fetch the next page.
  */
 export const managementListMailboxes = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes',
     ...options
 });
@@ -206,7 +206,7 @@ export const managementListMailboxes = (options) => (options?.client ?? client).
  * Supply an `Idempotency-Key` header (any unique string, max 255 chars) to safely retry on network errors. Replays with the same key return the original response; replays with a different body return `409 idempotency_conflict`.
  */
 export const managementCreateMailbox = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes',
     ...options,
     headers: {
@@ -220,7 +220,7 @@ export const managementCreateMailbox = (options) => (options?.client ?? client).
  * Removes a mailbox from our mail platform, Amazon SES (for `@myagent.mx` addresses), and Sendmux. All associated API keys are revoked.
  */
 export const managementDeleteMailbox = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}',
     ...options
 });
@@ -230,7 +230,7 @@ export const managementDeleteMailbox = (options) => (options.client ?? client).d
  * Returns a single mailbox, tenant-scoped to the caller's team. Responses carry a weak `ETag` header — send it back as `If-None-Match` on the next request and the server will return `304 Not Modified` (no body) when the resource has not changed. The same ETag is the value to use in `If-Match` on PATCH for optimistic concurrency.
  */
 export const managementGetMailbox = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}',
     ...options
 });
@@ -242,7 +242,7 @@ export const managementGetMailbox = (options) => (options.client ?? client).get(
  * For optimistic concurrency, send `If-Match: <etag>` using the ETag from a prior GET. A mismatched `If-Match` returns `409 conflict` (the server's ETag is echoed back so you can decide whether to re-fetch). Responses carry the new ETag so chained edits can pipeline without a re-GET.
  */
 export const managementUpdateMailbox = (options) => (options.client ?? client).patch({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}',
     ...options,
     headers: {
@@ -258,7 +258,7 @@ export const managementUpdateMailbox = (options) => (options.client ?? client).p
  * Responses carry a weak `ETag` — send it as `If-None-Match` to skip the body when the filter set has not changed (returns `304 Not Modified`). The same ETag is the value to use in `If-Match` on the corresponding PUT for optimistic concurrency.
  */
 export const managementGetMailboxFilters = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/filters',
     ...options
 });
@@ -270,7 +270,7 @@ export const managementGetMailboxFilters = (options) => (options.client ?? clien
  * For optimistic concurrency, send `If-Match: <etag>` using the ETag from a prior GET. A mismatched `If-Match` returns `409 conflict` (the server's ETag is echoed back so you can decide whether to re-fetch). Responses carry the new ETag so chained edits can pipeline without a re-GET.
  */
 export const managementSetMailboxFilters = (options) => (options.client ?? client).put({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/filters',
     ...options,
     headers: {
@@ -286,7 +286,7 @@ export const managementSetMailboxFilters = (options) => (options.client ?? clien
  * Supply an `Idempotency-Key` header (any unique string, max 255 chars) to safely retry on network errors. Replays with the same key return the original response; replays with a different body return `409 idempotency_conflict`.
  */
 export const managementCreateMailboxKey = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/keys',
     ...options,
     headers: {
@@ -300,7 +300,7 @@ export const managementCreateMailboxKey = (options) => (options.client ?? client
  * Revokes a specific bearer token + matching mailbox password. Idempotent on already-revoked keys.
  */
 export const managementDeleteMailboxKey = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/keys/{key_id}',
     ...options
 });
@@ -310,7 +310,7 @@ export const managementDeleteMailboxKey = (options) => (options.client ?? client
  * Restores a suspended mailbox so it can authenticate, receive mail, and send from the mailbox address again. The operation is idempotent and accepts `Idempotency-Key` for safe retries.
  */
 export const managementResumeMailbox = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/resume',
     ...options
 });
@@ -320,7 +320,7 @@ export const managementResumeMailbox = (options) => (options.client ?? client).p
  * Suspends a mailbox without deleting messages, credentials, or settings. Suspended mailboxes cannot receive mail, authenticate to mailbox protocols, or send from the mailbox address. The operation is idempotent and accepts `Idempotency-Key` for safe retries.
  */
 export const managementSuspendMailbox = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/{public_id}/suspend',
     ...options
 });
@@ -330,7 +330,7 @@ export const managementSuspendMailbox = (options) => (options.client ?? client).
  * Checks whether an email address can be reserved for mailbox creation. `@myagent.mx` availability is global across all teams; custom-domain availability is scoped to the caller's team and requires a verified send/receive mailbox domain.
  */
 export const managementCheckMailboxAvailability = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/mailboxes/availability',
     ...options
 });
@@ -340,7 +340,7 @@ export const managementCheckMailboxAvailability = (options) => (options.client ?
  * Validate this credential and return its team, connection label, permissions and authorised mailboxes. No additional read permission or mailbox selection is required. Mailbox storage and sending availability are not checked. No user profile or secrets are returned.
  */
 export const managementGetConnection = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/me',
     ...options
 });
@@ -350,7 +350,7 @@ export const managementGetConnection = (options) => (options?.client ?? client).
  * Returns a cursor-paginated list of sending accounts. Credentials are never returned. The shared Amazon SES account is included and marked with `is_shared: true`.
  */
 export const managementListProviders = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers',
     ...options
 });
@@ -360,7 +360,7 @@ export const managementListProviders = (options) => (options?.client ?? client).
  * Creates a custom SMTP sending account. Supply an `Idempotency-Key` header to safely retry on network errors. The SMTP password is stored securely and is never returned.
  */
 export const managementCreateProvider = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers',
     ...options,
     headers: {
@@ -374,7 +374,7 @@ export const managementCreateProvider = (options) => (options?.client ?? client)
  * Deletes a custom or connected sending account. The shared Amazon SES account cannot be deleted.
  */
 export const managementDeleteProvider = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}',
     ...options
 });
@@ -384,7 +384,7 @@ export const managementDeleteProvider = (options) => (options.client ?? client).
  * Returns one sending account. Responses include an ETag for conditional GET and optimistic PATCH.
  */
 export const managementGetProvider = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}',
     ...options
 });
@@ -394,7 +394,7 @@ export const managementGetProvider = (options) => (options.client ?? client).get
  * Updates a custom sending account. The shared Amazon SES account cannot be edited here; use activate/deactivate and the limit-request endpoint for the allowed shared-account actions.
  */
 export const managementUpdateProvider = (options) => (options.client ?? client).patch({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}',
     ...options,
     headers: {
@@ -408,7 +408,7 @@ export const managementUpdateProvider = (options) => (options.client ?? client).
  * Enables a sending account. OAuth accounts without an active connection are moved to pending until reconnected in the dashboard. The shared Amazon SES account can be activated.
  */
 export const managementActivateProvider = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}/activate',
     ...options
 });
@@ -418,7 +418,7 @@ export const managementActivateProvider = (options) => (options.client ?? client
  * Disables a sending account. The shared Amazon SES account can be deactivated.
  */
 export const managementDeactivateProvider = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}/deactivate',
     ...options
 });
@@ -428,7 +428,7 @@ export const managementDeactivateProvider = (options) => (options.client ?? clie
  * Runs a connection test for a custom SMTP account. The shared Amazon SES account and OAuth accounts cannot be tested through this endpoint.
  */
 export const managementTestProvider = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/{public_id}/test',
     ...options
 });
@@ -438,7 +438,7 @@ export const managementTestProvider = (options) => (options.client ?? client).po
  * Returns custom-account capacity and shared Amazon SES daily sending limit state.
  */
 export const managementGetProviderLimits = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/limits',
     ...options
 });
@@ -448,7 +448,7 @@ export const managementGetProviderLimits = (options) => (options?.client ?? clie
  * Creates a request to increase the number of custom or connected sending accounts allowed for the team.
  */
 export const managementRequestSendingAccountLimitIncrease = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/limits/sending-accounts/request-increase',
     ...options
 });
@@ -458,7 +458,7 @@ export const managementRequestSendingAccountLimitIncrease = (options) => (option
  * Returns the shared Amazon SES daily limit state and any pending increase request.
  */
 export const managementGetSharedAmazonSesLimitRequest = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/shared-amazon-ses-limit-request',
     ...options
 });
@@ -468,7 +468,7 @@ export const managementGetSharedAmazonSesLimitRequest = (options) => (options?.c
  * Creates a review request for the shared Amazon SES daily sending limit. This does not modify the limit directly.
  */
 export const managementCreateSharedAmazonSesLimitRequest = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/shared-amazon-ses-limit-request',
     ...options
 });
@@ -478,7 +478,7 @@ export const managementCreateSharedAmazonSesLimitRequest = (options) => (options
  * Cancels a pending shared Amazon SES daily limit increase request for the caller's team. Approved or denied requests cannot be cancelled.
  */
 export const managementCancelSharedAmazonSesLimitRequest = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/shared-amazon-ses-limit-request/{request_id}',
     ...options
 });
@@ -488,7 +488,7 @@ export const managementCancelSharedAmazonSesLimitRequest = (options) => (options
  * Returns aggregate counts of configured sending accounts with breakdowns by type and status.
  */
 export const managementGetProviderStats = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/stats',
     ...options
 });
@@ -498,7 +498,7 @@ export const managementGetProviderStats = (options) => (options?.client ?? clien
  * Returns per-account delivery-log counts for today and the trailing 7-day window.
  */
 export const managementGetProviderUsage = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/providers/usage',
     ...options
 });
@@ -508,7 +508,7 @@ export const managementGetProviderUsage = (options) => (options?.client ?? clien
  * Returns a cursor-paginated list of webhook subscriptions configured for the team, ordered by `created_at` descending. The signing secret is never included. Pass `cursor=<next_cursor>` from the previous response to fetch the next page.
  */
 export const managementListWebhooks = (options) => (options?.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks',
     ...options
 });
@@ -520,7 +520,7 @@ export const managementListWebhooks = (options) => (options?.client ?? client).g
  * Supply an `Idempotency-Key` header (any unique string, max 255 chars) to safely retry on network errors. Replays with the same key return the original response; replays with a different body return `409 idempotency_conflict`.
  */
 export const managementCreateWebhook = (options) => (options?.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks',
     ...options,
     headers: {
@@ -534,7 +534,7 @@ export const managementCreateWebhook = (options) => (options?.client ?? client).
  * Permanently removes the subscription. In-flight retries are dropped.
  */
 export const managementDeleteWebhook = (options) => (options.client ?? client).delete({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}',
     ...options
 });
@@ -544,7 +544,7 @@ export const managementDeleteWebhook = (options) => (options.client ?? client).d
  * Returns a single webhook subscription. The signing secret is never included. Responses carry a weak `ETag` header — send it back as `If-None-Match` on the next request and the server will return `304 Not Modified` (no body) when the resource has not changed. The same ETag is the value to use in `If-Match` on PATCH for optimistic concurrency.
  */
 export const managementGetWebhook = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}',
     ...options
 });
@@ -556,7 +556,7 @@ export const managementGetWebhook = (options) => (options.client ?? client).get(
  * For optimistic concurrency, send `If-Match: <etag>` using the ETag from a prior GET. A mismatched `If-Match` returns `409 conflict` (the server's ETag is echoed back so you can decide whether to re-fetch). Responses carry the new ETag so chained edits can pipeline without a re-GET.
  */
 export const managementUpdateWebhook = (options) => (options.client ?? client).patch({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}',
     ...options,
     headers: {
@@ -570,7 +570,7 @@ export const managementUpdateWebhook = (options) => (options.client ?? client).p
  * Returns recent delivery attempts for one webhook subscription, ordered by `created_at` descending. Delivery metadata is retained for 7 days. Use the payload endpoint while `payload_available` is true to inspect the exact JSON request body that was delivered.
  */
 export const managementListDelivery = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}/deliveries',
     ...options
 });
@@ -580,7 +580,7 @@ export const managementListDelivery = (options) => (options.client ?? client).ge
  * Returns the retained JSON request body for one delivery attempt. Payloads are retained for 7 days and may no longer be available after `payload_expires_at`.
  */
 export const managementGetDeliveryPayload = (options) => (options.client ?? client).get({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}/deliveries/{delivery_id}/payload',
     ...options
 });
@@ -592,7 +592,7 @@ export const managementGetDeliveryPayload = (options) => (options.client ?? clie
  * Supply an `Idempotency-Key` header to safely retry on network errors — replays under the same key return the original rotation response rather than minting a fresh secret. Replays against a different `public_id` under the same key return `409 idempotency_conflict`.
  */
 export const managementRotateWebhookSecret = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}/rotate-secret',
     ...options
 });
@@ -604,7 +604,7 @@ export const managementRotateWebhookSecret = (options) => (options.client ?? cli
  * Supply an `Idempotency-Key` header to safely retry on network errors — replays under the same key return the original `event_id` rather than publishing a second test event.
  */
 export const managementTestWebhook = (options) => (options.client ?? client).post({
-    security: [{ scheme: 'bearer', type: 'http' }],
+    security: [{ scheme: 'bearer', type: 'http' }, { scheme: 'bearer', type: 'http' }],
     url: '/webhooks/{public_id}/test',
     ...options
 });

package/dist/generated/types.gen.d.ts

@@ -2461,7 +2461,7 @@ export type ManagementResumeMailboxData = {
 };
 export type ManagementResumeMailboxErrors = {
     /**
-     * Root API key required
+     * Management API access required
      */
     403: ApiError;
     /**
@@ -2504,7 +2504,7 @@ export type ManagementSuspendMailboxData = {
 };
 export type ManagementSuspendMailboxErrors = {
     /**
-     * Root API key required
+     * Management API access required
      */
     403: ApiError;
     /**
@@ -2545,7 +2545,7 @@ export type ManagementCheckMailboxAvailabilityErrors = {
      */
     401: ApiError;
     /**
-     * Root API key with mailbox.admin.create is required
+     * Management API access with mailbox.admin.create is required
      */
     403: ApiError;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendmux/management",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -11,7 +11,7 @@
     "dist"
   ],
   "dependencies": {
-    "@sendmux/core": "1.1.0"
+    "@sendmux/core": "1.2.0"
   },
   "repository": {
     "type": "git",