@spaciv/sdk 0.0.0 → 0.1.0

package/dist/esm/apis/AuthenticationApi.d.ts

@@ -0,0 +1,381 @@
+/**
+ * spaciv API
+ * The spaciv API powers workplace planning: modelling how many people an organisation has, how they work, and how much space that requires.  ## Getting started  1. Exchange credentials for an access token using one of the operations under    **Authentication**. 2. Send that token on every subsequent request as `Authorization: Bearer <token>`. 3. Access tokens are short lived. Call `POST /v1/auth/refresh-token` to obtain a new one    before the old one expires.  ## Conventions  Every operation is versioned under `/v1`. Collections are plural (`GET /v1/dashboards` lists, `POST /v1/dashboards` creates) and individual records live beneath them (`/v1/dashboards/{id}`). Singular paths such as `/v1/account`, `/v1/project` and `/v1/user` refer to the record the access token was issued for.  Request and response bodies are JSON. Timestamps are RFC 3339. Identifiers are opaque strings unless documented otherwise, and collection operations return the records visible to the account the token was issued for.  Failures return an [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) problem document with a `detail` field describing what went wrong.
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@spaciv.com
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import type { APIKey, ApiKeyPostReqBody, ApiKeyPostResBody, AuthAPIKeyTokenReqBody, AuthAPIKeyTokenResBody, AuthLoginPassReqBody, AuthLoginPublicReqBody, AuthLoginResBody, AuthLoginTokenReqBody, AuthRefreshTokenReqBody, AuthRefreshTokenResBody, AuthSendTokenReqBody, Cookie, PasswordPutReqBody, SendPasswordPutReqBody } from '../models/index';
+export interface AuthenticationApiCreateApiKeysRequest {
+    apiKeyPostReqBody: ApiKeyPostReqBody;
+}
+export interface AuthenticationApiCreateAuthApiKeyTokenRequest {
+    authAPIKeyTokenReqBody: AuthAPIKeyTokenReqBody;
+}
+export interface AuthenticationApiCreateAuthLoginPasswordRequest {
+    authLoginPassReqBody: AuthLoginPassReqBody;
+}
+export interface AuthenticationApiCreateAuthLoginPublicRequest {
+    authLoginPublicReqBody: AuthLoginPublicReqBody;
+}
+export interface AuthenticationApiCreateAuthLoginTokenRequest {
+    authLoginTokenReqBody: AuthLoginTokenReqBody;
+}
+export interface AuthenticationApiCreateAuthLogoutRequest {
+    hostToken?: Cookie;
+    token?: Cookie;
+}
+export interface AuthenticationApiCreateAuthRefreshTokenRequest {
+    authRefreshTokenReqBody: AuthRefreshTokenReqBody;
+    hostToken?: Cookie;
+    token?: Cookie;
+}
+export interface AuthenticationApiCreateAuthSendPasswordResetRequest {
+    sendPasswordPutReqBody: SendPasswordPutReqBody;
+}
+export interface AuthenticationApiCreateAuthSendTokenRequest {
+    authSendTokenReqBody: AuthSendTokenReqBody;
+}
+export interface AuthenticationApiDeleteApiKeysRequest {
+    id: number;
+}
+export interface AuthenticationApiGetAuthLoginOidcRequest {
+    code?: string;
+    hostname?: string;
+}
+export interface AuthenticationApiUpdateAuthPasswordRequest {
+    passwordPutReqBody: PasswordPutReqBody;
+}
+/**
+ * AuthenticationApi - interface
+ *
+ * @export
+ * @interface AuthenticationApiInterface
+ */
+export interface AuthenticationApiInterface {
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * @summary Create an API key
+     * @param {ApiKeyPostReqBody} apiKeyPostReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createApiKeysRaw(requestParameters: AuthenticationApiCreateApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApiKeyPostResBody>>;
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * Create an API key
+     */
+    createApiKeys(requestParameters: AuthenticationApiCreateApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApiKeyPostResBody>;
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * @summary Exchange an API key for an access token
+     * @param {AuthAPIKeyTokenReqBody} authAPIKeyTokenReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthApiKeyTokenRaw(requestParameters: AuthenticationApiCreateAuthApiKeyTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthAPIKeyTokenResBody>>;
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * Exchange an API key for an access token
+     */
+    createAuthApiKeyToken(requestParameters: AuthenticationApiCreateAuthApiKeyTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthAPIKeyTokenResBody>;
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * @summary Sign in with email and password
+     * @param {AuthLoginPassReqBody} authLoginPassReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthLoginPasswordRaw(requestParameters: AuthenticationApiCreateAuthLoginPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * Sign in with email and password
+     */
+    createAuthLoginPassword(requestParameters: AuthenticationApiCreateAuthLoginPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * @summary Sign in as a public contributor
+     * @param {AuthLoginPublicReqBody} authLoginPublicReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthLoginPublicRaw(requestParameters: AuthenticationApiCreateAuthLoginPublicRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * Sign in as a public contributor
+     */
+    createAuthLoginPublic(requestParameters: AuthenticationApiCreateAuthLoginPublicRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * @summary Sign in with a magic link token
+     * @param {AuthLoginTokenReqBody} authLoginTokenReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthLoginTokenRaw(requestParameters: AuthenticationApiCreateAuthLoginTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * Sign in with a magic link token
+     */
+    createAuthLoginToken(requestParameters: AuthenticationApiCreateAuthLoginTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * @summary Sign out
+     * @param {Cookie} [hostToken]
+     * @param {Cookie} [token]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthLogoutRaw(requestParameters: AuthenticationApiCreateAuthLogoutRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * Sign out
+     */
+    createAuthLogout(requestParameters: AuthenticationApiCreateAuthLogoutRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * @summary Refresh an access token
+     * @param {AuthRefreshTokenReqBody} authRefreshTokenReqBody
+     * @param {Cookie} [hostToken]
+     * @param {Cookie} [token]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthRefreshTokenRaw(requestParameters: AuthenticationApiCreateAuthRefreshTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthRefreshTokenResBody>>;
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * Refresh an access token
+     */
+    createAuthRefreshToken(requestParameters: AuthenticationApiCreateAuthRefreshTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthRefreshTokenResBody>;
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * @summary Request a password reset
+     * @param {SendPasswordPutReqBody} sendPasswordPutReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthSendPasswordResetRaw(requestParameters: AuthenticationApiCreateAuthSendPasswordResetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * Request a password reset
+     */
+    createAuthSendPasswordReset(requestParameters: AuthenticationApiCreateAuthSendPasswordResetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * @summary Send a magic link sign-in email
+     * @param {AuthSendTokenReqBody} authSendTokenReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    createAuthSendTokenRaw(requestParameters: AuthenticationApiCreateAuthSendTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * Send a magic link sign-in email
+     */
+    createAuthSendToken(requestParameters: AuthenticationApiCreateAuthSendTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * @summary Revoke an API key
+     * @param {number} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    deleteApiKeysRaw(requestParameters: AuthenticationApiDeleteApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * Revoke an API key
+     */
+    deleteApiKeys(requestParameters: AuthenticationApiDeleteApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * @summary Sign in via OIDC
+     * @param {string} [code]
+     * @param {string} [hostname] The account hostname that determines which OIDC provider to authenticate against.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    getAuthLoginOidcRaw(requestParameters: AuthenticationApiGetAuthLoginOidcRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * Sign in via OIDC
+     */
+    getAuthLoginOidc(requestParameters: AuthenticationApiGetAuthLoginOidcRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * @summary List API keys
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    listApiKeysRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<APIKey>>>;
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * List API keys
+     */
+    listApiKeys(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<APIKey>>;
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * @summary Set a new password
+     * @param {PasswordPutReqBody} passwordPutReqBody
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthenticationApiInterface
+     */
+    updateAuthPasswordRaw(requestParameters: AuthenticationApiUpdateAuthPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * Set a new password
+     */
+    updateAuthPassword(requestParameters: AuthenticationApiUpdateAuthPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}
+/**
+ *
+ */
+export declare class AuthenticationApi extends runtime.BaseAPI implements AuthenticationApiInterface {
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * Create an API key
+     */
+    createApiKeysRaw(requestParameters: AuthenticationApiCreateApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApiKeyPostResBody>>;
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * Create an API key
+     */
+    createApiKeys(requestParameters: AuthenticationApiCreateApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApiKeyPostResBody>;
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * Exchange an API key for an access token
+     */
+    createAuthApiKeyTokenRaw(requestParameters: AuthenticationApiCreateAuthApiKeyTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthAPIKeyTokenResBody>>;
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * Exchange an API key for an access token
+     */
+    createAuthApiKeyToken(requestParameters: AuthenticationApiCreateAuthApiKeyTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthAPIKeyTokenResBody>;
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * Sign in with email and password
+     */
+    createAuthLoginPasswordRaw(requestParameters: AuthenticationApiCreateAuthLoginPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * Sign in with email and password
+     */
+    createAuthLoginPassword(requestParameters: AuthenticationApiCreateAuthLoginPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * Sign in as a public contributor
+     */
+    createAuthLoginPublicRaw(requestParameters: AuthenticationApiCreateAuthLoginPublicRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * Sign in as a public contributor
+     */
+    createAuthLoginPublic(requestParameters: AuthenticationApiCreateAuthLoginPublicRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * Sign in with a magic link token
+     */
+    createAuthLoginTokenRaw(requestParameters: AuthenticationApiCreateAuthLoginTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * Sign in with a magic link token
+     */
+    createAuthLoginToken(requestParameters: AuthenticationApiCreateAuthLoginTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * Sign out
+     */
+    createAuthLogoutRaw(requestParameters: AuthenticationApiCreateAuthLogoutRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * Sign out
+     */
+    createAuthLogout(requestParameters?: AuthenticationApiCreateAuthLogoutRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * Refresh an access token
+     */
+    createAuthRefreshTokenRaw(requestParameters: AuthenticationApiCreateAuthRefreshTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthRefreshTokenResBody>>;
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * Refresh an access token
+     */
+    createAuthRefreshToken(requestParameters: AuthenticationApiCreateAuthRefreshTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthRefreshTokenResBody>;
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * Request a password reset
+     */
+    createAuthSendPasswordResetRaw(requestParameters: AuthenticationApiCreateAuthSendPasswordResetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * Request a password reset
+     */
+    createAuthSendPasswordReset(requestParameters: AuthenticationApiCreateAuthSendPasswordResetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * Send a magic link sign-in email
+     */
+    createAuthSendTokenRaw(requestParameters: AuthenticationApiCreateAuthSendTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * Send a magic link sign-in email
+     */
+    createAuthSendToken(requestParameters: AuthenticationApiCreateAuthSendTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * Revoke an API key
+     */
+    deleteApiKeysRaw(requestParameters: AuthenticationApiDeleteApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * Revoke an API key
+     */
+    deleteApiKeys(requestParameters: AuthenticationApiDeleteApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * Sign in via OIDC
+     */
+    getAuthLoginOidcRaw(requestParameters: AuthenticationApiGetAuthLoginOidcRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthLoginResBody>>;
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * Sign in via OIDC
+     */
+    getAuthLoginOidc(requestParameters?: AuthenticationApiGetAuthLoginOidcRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthLoginResBody>;
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * List API keys
+     */
+    listApiKeysRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<APIKey>>>;
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * List API keys
+     */
+    listApiKeys(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<APIKey>>;
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * Set a new password
+     */
+    updateAuthPasswordRaw(requestParameters: AuthenticationApiUpdateAuthPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * Set a new password
+     */
+    updateAuthPassword(requestParameters: AuthenticationApiUpdateAuthPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}