@spaciv/sdk 0.0.0 → 0.1.0

package/dist/esm/apis/AuthenticationApi.js

@@ -0,0 +1,464 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * spaciv API
+ * The spaciv API powers workplace planning: modelling how many people an organisation has, how they work, and how much space that requires.  ## Getting started  1. Exchange credentials for an access token using one of the operations under    **Authentication**. 2. Send that token on every subsequent request as `Authorization: Bearer <token>`. 3. Access tokens are short lived. Call `POST /v1/auth/refresh-token` to obtain a new one    before the old one expires.  ## Conventions  Every operation is versioned under `/v1`. Collections are plural (`GET /v1/dashboards` lists, `POST /v1/dashboards` creates) and individual records live beneath them (`/v1/dashboards/{id}`). Singular paths such as `/v1/account`, `/v1/project` and `/v1/user` refer to the record the access token was issued for.  Request and response bodies are JSON. Timestamps are RFC 3339. Identifiers are opaque strings unless documented otherwise, and collection operations return the records visible to the account the token was issued for.  Failures return an [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) problem document with a `detail` field describing what went wrong.
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@spaciv.com
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import * as runtime from '../runtime';
+import { APIKeyFromJSON, ApiKeyPostReqBodyToJSON, ApiKeyPostResBodyFromJSON, AuthAPIKeyTokenReqBodyToJSON, AuthAPIKeyTokenResBodyFromJSON, AuthLoginPassReqBodyToJSON, AuthLoginPublicReqBodyToJSON, AuthLoginResBodyFromJSON, AuthLoginTokenReqBodyToJSON, AuthRefreshTokenReqBodyToJSON, AuthRefreshTokenResBodyFromJSON, AuthSendTokenReqBodyToJSON, PasswordPutReqBodyToJSON, SendPasswordPutReqBodyToJSON, } from '../models/index';
+/**
+ *
+ */
+export class AuthenticationApi extends runtime.BaseAPI {
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * Create an API key
+     */
+    createApiKeysRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['apiKeyPostReqBody'] == null) {
+                throw new runtime.RequiredError('apiKeyPostReqBody', 'Required parameter "apiKeyPostReqBody" was null or undefined when calling createApiKeys().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("accessToken", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            let urlPath = `/v1/api-keys`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: ApiKeyPostReqBodyToJSON(requestParameters['apiKeyPostReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => ApiKeyPostResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Issues a long-lived key for programmatic access, scoped to the calling user and the given project. The secret is returned in the `key` field of this response and never again, since only its hash is stored; a client that loses it must create a replacement. Keys expire after `expiresInDays`, between 1 and 90.
+     * Create an API key
+     */
+    createApiKeys(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createApiKeysRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * Exchange an API key for an access token
+     */
+    createAuthApiKeyTokenRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authAPIKeyTokenReqBody'] == null) {
+                throw new runtime.RequiredError('authAPIKeyTokenReqBody', 'Required parameter "authAPIKeyTokenReqBody" was null or undefined when calling createAuthApiKeyToken().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/api-key-token`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthAPIKeyTokenReqBodyToJSON(requestParameters['authAPIKeyTokenReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthAPIKeyTokenResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Trades an API key for a short-lived access token carrying the features its owner currently holds. Clients that make many calls should prefer this over sending the key itself, and refresh the token when it expires. Unlike the other operations in this section, no access token is required to call it.
+     * Exchange an API key for an access token
+     */
+    createAuthApiKeyToken(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createAuthApiKeyTokenRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * Sign in with email and password
+     */
+    createAuthLoginPasswordRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authLoginPassReqBody'] == null) {
+                throw new runtime.RequiredError('authLoginPassReqBody', 'Required parameter "authLoginPassReqBody" was null or undefined when calling createAuthLoginPassword().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/login-password`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthLoginPassReqBodyToJSON(requestParameters['authLoginPassReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthLoginResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Authenticates with an email address and plaintext password. Returns a short-lived access token in the response body and sets a long-lived refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false). Returns `401` if the credentials do not match or email-and-password sign-in is disabled for the account.
+     * Sign in with email and password
+     */
+    createAuthLoginPassword(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createAuthLoginPasswordRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * Sign in as a public contributor
+     */
+    createAuthLoginPublicRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authLoginPublicReqBody'] == null) {
+                throw new runtime.RequiredError('authLoginPublicReqBody', 'Required parameter "authLoginPublicReqBody" was null or undefined when calling createAuthLoginPublic().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/login-public`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthLoginPublicReqBodyToJSON(requestParameters['authLoginPublicReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthLoginResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Creates an anonymous session for a data collection contributor who has no spaciv account. The caller must pass `acceptTerms: true`; the request is rejected with `400` otherwise. Returns `401` if public sign-in is disabled for the account.  The resulting access token grants only the permissions needed to view and submit public surveys.
+     * Sign in as a public contributor
+     */
+    createAuthLoginPublic(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createAuthLoginPublicRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * Sign in with a magic link token
+     */
+    createAuthLoginTokenRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authLoginTokenReqBody'] == null) {
+                throw new runtime.RequiredError('authLoginTokenReqBody', 'Required parameter "authLoginTokenReqBody" was null or undefined when calling createAuthLoginToken().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/login-token`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthLoginTokenReqBodyToJSON(requestParameters['authLoginTokenReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthLoginResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Exchanges a short-lived magic link token (issued by `POST /v1/auth/send-token`) for an access token and a refresh token cookie. Returns `401` if the token is invalid or expired, or magic-link sign-in is disabled for the account.
+     * Sign in with a magic link token
+     */
+    createAuthLoginToken(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createAuthLoginTokenRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * Sign out
+     */
+    createAuthLogoutRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const queryParameters = {};
+            const headerParameters = {};
+            let urlPath = `/v1/auth/logout`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.VoidApiResponse(response);
+        });
+    }
+    /**
+     * Revokes the session behind the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false), so it can no longer be exchanged for access tokens, and clears the cookie. Succeeds without revoking anything when the cookie is missing or invalid. Returns `500` without clearing the cookie when the revocation itself fails, so the session is still live and the sign-out should be retried. The access token itself remains valid until it expires (typically within 5 minutes).
+     * Sign out
+     */
+    createAuthLogout() {
+        return __awaiter(this, arguments, void 0, function* (requestParameters = {}, initOverrides) {
+            yield this.createAuthLogoutRaw(requestParameters, initOverrides);
+        });
+    }
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * Refresh an access token
+     */
+    createAuthRefreshTokenRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authRefreshTokenReqBody'] == null) {
+                throw new runtime.RequiredError('authRefreshTokenReqBody', 'Required parameter "authRefreshTokenReqBody" was null or undefined when calling createAuthRefreshToken().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/refresh-token`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthRefreshTokenReqBodyToJSON(requestParameters['authRefreshTokenReqBody']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthRefreshTokenResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Exchanges the refresh token cookie (`__Host-token`, or `token` when `AUTH_COOKIE_SECURE` is false) for a fresh short-lived access token. Optionally scope the token to a specific account or project by providing `account` and/or `project` in the request body. For OIDC accounts, the provider\'s token is silently re-validated on each refresh.  A successful refresh rotates the cookie, keeping the session\'s original expiry. The session\'s refresh token advances at most once a minute: within that minute, presenting the current token sets no cookie, and presenting the token it just replaced sets a cookie for the current one. A superseded refresh token is still accepted for a short grace period, so parallel refreshes and retries succeed; presenting it after that revokes the whole session.  Returns `401` when no access token could be minted: an invalid refresh token, a missing or signed-out session, a reused refresh token, a deleted user, or, for a refresh scoped to an `account`, unusable session data or an OIDC provider that rejects the session\'s token. Returning the user to sign-in is the usual response.  Returns `503` when, for a refresh scoped to an `account`, the OIDC provider could not be reached or reported a transient failure. The session is still valid, so retry the refresh later rather than signing the user out.  Returns `403` when the session is valid but is not authorised for the requested `account`, which typically means the account mandates a sign-in method the session did not use. The session stays usable for other accounts, so keep it and cancel only the account-scoped action.
+     * Refresh an access token
+     */
+    createAuthRefreshToken(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.createAuthRefreshTokenRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * Request a password reset
+     */
+    createAuthSendPasswordResetRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['sendPasswordPutReqBody'] == null) {
+                throw new runtime.RequiredError('sendPasswordPutReqBody', 'Required parameter "sendPasswordPutReqBody" was null or undefined when calling createAuthSendPasswordReset().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/send-password-reset`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: SendPasswordPutReqBodyToJSON(requestParameters['sendPasswordPutReqBody']),
+            }, initOverrides);
+            return new runtime.VoidApiResponse(response);
+        });
+    }
+    /**
+     * Sends a password-reset email to the given address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The emailed token is valid for 15 minutes and must be passed to `PUT /v1/auth/password`.
+     * Request a password reset
+     */
+    createAuthSendPasswordReset(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.createAuthSendPasswordResetRaw(requestParameters, initOverrides);
+        });
+    }
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * Send a magic link sign-in email
+     */
+    createAuthSendTokenRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authSendTokenReqBody'] == null) {
+                throw new runtime.RequiredError('authSendTokenReqBody', 'Required parameter "authSendTokenReqBody" was null or undefined when calling createAuthSendToken().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/send-token`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: AuthSendTokenReqBodyToJSON(requestParameters['authSendTokenReqBody']),
+            }, initOverrides);
+            return new runtime.VoidApiResponse(response);
+        });
+    }
+    /**
+     * Sends a one-time sign-in link to the given email address. Always returns `200` regardless of whether the address is registered, to avoid account enumeration. The link is valid for 15 minutes; pass its token to `POST /v1/auth/login-token`.
+     * Send a magic link sign-in email
+     */
+    createAuthSendToken(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.createAuthSendTokenRaw(requestParameters, initOverrides);
+        });
+    }
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * Revoke an API key
+     */
+    deleteApiKeysRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['id'] == null) {
+                throw new runtime.RequiredError('id', 'Required parameter "id" was null or undefined when calling deleteApiKeys().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("accessToken", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            let urlPath = `/v1/api-keys/{id}`;
+            urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+            const response = yield this.request({
+                path: urlPath,
+                method: 'DELETE',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.VoidApiResponse(response);
+        });
+    }
+    /**
+     * Permanently revokes one of the calling user\'s keys. Access tokens already exchanged for it remain valid until they expire, and the key itself may continue to authenticate for up to a minute while cached resolutions age out.
+     * Revoke an API key
+     */
+    deleteApiKeys(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.deleteApiKeysRaw(requestParameters, initOverrides);
+        });
+    }
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * Sign in via OIDC
+     */
+    getAuthLoginOidcRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const queryParameters = {};
+            if (requestParameters['code'] != null) {
+                queryParameters['code'] = requestParameters['code'];
+            }
+            if (requestParameters['hostname'] != null) {
+                queryParameters['hostname'] = requestParameters['hostname'];
+            }
+            const headerParameters = {};
+            let urlPath = `/v1/auth/login-oidc`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => AuthLoginResBodyFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Exchanges an authorisation code from your account\'s configured OIDC provider (e.g. Microsoft Entra, PingFederate) for an access token and a refresh token cookie. Returns `401` before code exchange if single sign-on is disabled for the account.  If no user with the provider-returned email address exists it is created automatically. Call `GET /v1/auth/oidc/{hostname}` first to start the OIDC flow and obtain the code.
+     * Sign in via OIDC
+     */
+    getAuthLoginOidc() {
+        return __awaiter(this, arguments, void 0, function* (requestParameters = {}, initOverrides) {
+            const response = yield this.getAuthLoginOidcRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * List API keys
+     */
+    listApiKeysRaw(initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const queryParameters = {};
+            const headerParameters = {};
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("accessToken", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            let urlPath = `/v1/api-keys`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(APIKeyFromJSON));
+        });
+    }
+    /**
+     * Returns the calling user\'s keys for the current account, most recently created first. Only metadata is returned: each key\'s name, display prefix, expiry and last use, never the secret itself. Expired keys remain listed for 30 days so they can be recognised before they disappear.
+     * List API keys
+     */
+    listApiKeys(initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.listApiKeysRaw(initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * Set a new password
+     */
+    updateAuthPasswordRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['passwordPutReqBody'] == null) {
+                throw new runtime.RequiredError('passwordPutReqBody', 'Required parameter "passwordPutReqBody" was null or undefined when calling updateAuthPassword().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            let urlPath = `/v1/auth/password`;
+            const response = yield this.request({
+                path: urlPath,
+                method: 'PUT',
+                headers: headerParameters,
+                query: queryParameters,
+                body: PasswordPutReqBodyToJSON(requestParameters['passwordPutReqBody']),
+            }, initOverrides);
+            return new runtime.VoidApiResponse(response);
+        });
+    }
+    /**
+     * Sets the password for the user identified by a password-reset token (issued by `POST /v1/auth/send-password-reset`). Returns `401` if the token is invalid or expired.
+     * Set a new password
+     */
+    updateAuthPassword(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.updateAuthPasswordRaw(requestParameters, initOverrides);
+        });
+    }
+}