@unkey/api 0.22.1 → 0.24.0

package/dist/index.d.ts

@@ -37,6 +37,24 @@ interface paths {
   "/v1/keys.getVerifications": {
     get: operations["getVerifications"];
   };
+  "/v1/keys.addPermissions": {
+    post: operations["addPermissions"];
+  };
+  "/v1/keys.removePermissions": {
+    post: operations["removePermissions"];
+  };
+  "/v1/keys.setPermissions": {
+    post: operations["setPermissions"];
+  };
+  "/v1/keys.addRoles": {
+    post: operations["addRoles"];
+  };
+  "/v1/keys.removeRoles": {
+    post: operations["removeRoles"];
+  };
+  "/v1/keys.setRoles": {
+    post: operations["setRoles"];
+  };
   "/v1/apis.getApi": {
     get: operations["getApi"];
   };
@@ -61,6 +79,45 @@ interface paths {
   "/v1/migrations.enqueueKeys": {
     post: operations["v1.migrations.enqueueKeys"];
   };
+  "/v1/permissions.createPermission": {
+    post: operations["createPermission"];
+  };
+  "/v1/permissions.deletePermission": {
+    post: operations["deletePermission"];
+  };
+  "/v1/permissions.getPermission": {
+    get: operations["getPermission"];
+  };
+  "/v1/permissions.listPermissions": {
+    get: operations["listPermissions"];
+  };
+  "/v1/permissions.createRole": {
+    post: operations["createRole"];
+  };
+  "/v1/permissions.deleteRole": {
+    post: operations["deleteRole"];
+  };
+  "/v1/permissions.getRole": {
+    get: operations["getRole"];
+  };
+  "/v1/permissions.listRoles": {
+    get: operations["listRoles"];
+  };
+  "/v1/identities.createIdentity": {
+    post: operations["createIdentity"];
+  };
+  "/v1/identities.getIdentity": {
+    get: operations["getIdentity"];
+  };
+  "/v1/identities.listIdentities": {
+    get: operations["listIdentities"];
+  };
+  "/v1/identities.updateIdentity": {
+    post: operations["updateIdentity"];
+  };
+  "/v1/identities.deleteIdentity": {
+    post: operations["deleteIdentity"];
+  };
   "/v1/keys": {
     post: operations["deprecated.createKey"];
   };
@@ -283,11 +340,6 @@ interface components {
        * @example 0
        */
       updatedAt?: number;
-      /**
-       * @description The unix timestamp in milliseconds when the key was deleted. We don't delete the key outright, you can restore it later.
-       * @example 0
-       */
-      deletedAt?: number;
       /**
        * @description The unix timestamp in milliseconds when the key will expire. If this field is null or undefined, the key is not expiring.
        * @example 0
@@ -370,6 +422,17 @@ interface components {
       enabled?: boolean;
       /** @description The key in plaintext */
       plaintext?: string;
+      /** @description The identity of the key */
+      identity?: {
+        /** @description The id of the identity */
+        id: string;
+        /** @description The external id of the identity */
+        externalId: string;
+        /** @description Any additional metadata attached to the identity */
+        meta?: {
+          [key: string]: unknown;
+        };
+      };
     };
     V1KeysVerifyKeyResponse: {
       /**
@@ -412,7 +475,7 @@ interface components {
        */
       expires?: number;
       /**
-       * @description Multi ratelimits TODO:
+       * @description The ratelimit configuration for this key. If this field is null or undefined, the key has no ratelimit.
        * @example {
        *   "limit": 10,
        *   "remaining": 9,
@@ -452,10 +515,11 @@ interface components {
        * - UNAUTHORIZED: the key is not authorized
        * - DISABLED: the key is disabled
        * - INSUFFICIENT_PERMISSIONS: you do not have the required permissions to perform this action
+       * - EXPIRED: The key was only valid for a certain time and has expired.
        *
        * @enum {string}
        */
-      code: "VALID" | "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS";
+      code: "VALID" | "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS" | "EXPIRED";
       /** @description Sets the key to be enabled or disabled. Disabled keys will not verify. */
       enabled?: boolean;
       /**
@@ -471,6 +535,14 @@ interface components {
        * @example test
        */
       environment?: string;
+      /** @description The associated identity of this key. */
+      identity?: {
+        id: string;
+        externalId: string;
+        meta: {
+          [key: string]: unknown;
+        };
+      };
     };
     /** @description A query for which permissions you require */
     PermissionQuery: OneOf<[string, {
@@ -494,6 +566,10 @@ interface components {
       authorization?: {
         permissions?: components["schemas"]["PermissionQuery"];
       };
+      /**
+       * @deprecated
+       * @description Use 'ratelimits' with `[{ name: "default", cost: 2}]`
+       */
       ratelimit?: {
         /**
          * @description Override how many tokens are deducted during the ratelimit operation.
@@ -501,9 +577,25 @@ interface components {
          */
         cost?: number;
       };
+      /**
+       * @description You can check against multiple ratelimits when verifying a key. Let's say you are building an app that uses AI under the hood and you want to limit your customers to 500 requests per hour, but also ensure they use up less than 20k tokens per day.
+       *
+       * @example [
+       *   {
+       *     "name": "requests",
+       *     "limit": 500,
+       *     "duration": 3600000
+       *   },
+       *   {
+       *     "name": "tokens",
+       *     "limit": 20000,
+       *     "duration": 86400000
+       *   }
+       * ]
+       */
       ratelimits?: {
           /**
-           * @description The name of the ratelimit
+           * @description The name of the ratelimit.
            * @example tokens
            */
           name: string;
@@ -512,17 +604,34 @@ interface components {
            * @default 1
            */
           cost?: number;
-          /**
-           * @description The identifier used for ratelimiting. If omitted, we use the key's id.
-           * @default key id
-           */
-          identifier?: string;
           /** @description Optionally override the limit. */
           limit?: number;
           /** @description Optionally override the ratelimit window duration. */
           duration?: number;
         }[];
     };
+    ErrDeleteProtected: {
+      error: {
+        /**
+         * @description A machine readable error code.
+         * @example DELETE_PROTECTED
+         * @enum {string}
+         */
+        code: "DELETE_PROTECTED";
+        /**
+         * @description A link to our documentation with more details about this error code
+         * @example https://unkey.dev/docs/api-reference/errors/code/DELETE_PROTECTED
+         */
+        docs: string;
+        /** @description A human readable explanation of what went wrong */
+        message: string;
+        /**
+         * @description Please always include the requestId in your error report
+         * @example req_1234
+         */
+        requestId: string;
+      };
+    };
   };
   responses: never;
   parameters: {
@@ -756,11 +865,17 @@ interface operations {
            */
           byteLength?: number;
           /**
-           * @description Your user’s Id. This will provide a link between Unkey and your customer record.
-           * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
+           * @deprecated
+           * @description Deprecated, use `externalId`
            * @example team_123
            */
           ownerId?: string;
+          /**
+           * @description Your user's Id. This will provide a link between Unkey and your customer record.
+           * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
+           * @example team_123
+           */
+          externalId?: string;
           /**
            * @description This is a place for dynamic meta data, anything that feels useful for you should go here
            * @example {
@@ -858,6 +973,15 @@ interface operations {
            * @example false
            */
           enabled?: boolean;
+          /**
+           * @description You may want to show keys again later. While we do not recommend this, we leave this option open for you.
+           *
+           * In addition to storing the key's hash, recoverable keys are stored in an encrypted vault, allowing you to retrieve and display the plaintext later.
+           *
+           * https://www.unkey.com/docs/security/recovering-keys for more information.
+           * @default false
+           */
+          recoverable?: boolean;
           /**
            * @description Environments allow you to divide your keyspace.
            *
@@ -1041,24 +1165,33 @@ interface operations {
             /**
              * @deprecated
              * @description Fast ratelimiting doesn't add latency, while consistent ratelimiting is more accurate.
+             * Deprecated, use 'async' instead
              * @enum {string}
              */
             type?: "fast" | "consistent";
             /**
-             * @description Asnyc ratelimiting doesn't add latency, while sync ratelimiting is more accurate.
+             * @description Asnyc ratelimiting doesn't add latency, while sync ratelimiting is slightly more accurate.
              * @default false
              */
             async?: boolean;
-            /** @description The total amount of burstable requests. */
+            /** @description The total amount of requests allowed in a single window. */
             limit: number;
             /**
              * @deprecated
              * @description How many tokens to refill during each refillInterval.
+             * Deprecated, use 'limit' instead.
              */
             refillRate?: number;
-            /** @description Determines the speed at which tokens are refilled, in milliseconds. */
-            refillInterval: number;
-            /** @description The duration of each ratelimit window, in milliseconds. */
+            /**
+             * @deprecated
+             * @description Determines the speed at which tokens are refilled, in milliseconds.
+             * Deprecated, use 'duration'
+             */
+            refillInterval?: number;
+            /**
+             * @description The duration of each ratelimit window, in milliseconds.
+             * This field will become required in a future version.
+             */
             duration?: number;
           }) | null;
           /**
@@ -1087,6 +1220,60 @@ interface operations {
            * @example true
            */
           enabled?: boolean;
+          /**
+           * @description The roles you want to set for this key. This overwrites all existing roles.
+           *                 Setting roles requires the `rbac.*.add_role_to_key` permission.
+           * @example [
+           *   {
+           *     "id": "perm_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   },
+           *   {
+           *     "name": "dns.record.delete",
+           *     "create": true
+           *   }
+           * ]
+           */
+          roles?: {
+              /** @description The id of the role. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the role via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+              /**
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *                     Autocreating roles requires your root key to have the `rbac.*.create_role` permission, otherwise the request will get rejected
+               */
+              create?: boolean;
+            }[];
+          /**
+           * @description The permissions you want to set for this key. This overwrites all existing permissions.
+           *                 Setting permissions requires the `rbac.*.add_permission_to_key` permission.
+           * @example [
+           *   {
+           *     "id": "perm_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   },
+           *   {
+           *     "name": "dns.record.delete",
+           *     "create": true
+           *   }
+           * ]
+           */
+          permissions?: {
+              /** @description The id of the permission. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the permission via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+              /**
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *                     Autocreating permissions requires your root key to have the `rbac.*.create_permission` permission, otherwise the request will get rejected
+               */
+              create?: boolean;
+            }[];
         };
       };
     };
@@ -1304,33 +1491,43 @@ interface operations {
       };
     };
   };
-  getApi: {
-    parameters: {
-      query: {
-        apiId: string;
+  addPermissions: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
+          /** @description The permissions you want to add to this key */
+          permissions: {
+              /** @description The id of the permission. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the permission via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+              /**
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *               Autocreating permissions requires your root key to have the `rbac.*.create_permission` permission, otherwise the request will get rejected
+               */
+              create?: boolean;
+            }[];
+        };
       };
     };
     responses: {
-      /** @description The configuration for an api */
+      /** @description All currently connected permissions */
       200: {
         content: {
           "application/json": {
-            /**
-             * @description The id of the key
-             * @example key_1234
-             */
-            id: string;
-            /**
-             * @description The id of the workspace that owns the api
-             * @example ws_1234
-             */
-            workspaceId: string;
-            /**
-             * @description The name of the api. This is internal and your users will not see this.
-             * @example Unkey - Production
-             */
-            name?: string;
-          };
+              /**
+               * @description The id of the permission. This is used internally
+               * @example perm_123
+               */
+              id: string;
+              /**
+               * @description The name of the permission
+               * @example dns.record.create
+               */
+              name: string;
+            }[];
         };
       };
       /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
@@ -1377,29 +1574,37 @@ interface operations {
       };
     };
   };
-  createApi: {
+  removePermissions: {
     requestBody: {
       content: {
         "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
           /**
-           * @description The name for your API. This is not customer facing.
-           * @example my-api
+           * @description The permissions you want to remove from this key.
+           * @example [
+           *   {
+           *     "id": "perm_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   }
+           * ]
            */
-          name: string;
+          permissions: {
+              /** @description The id of the permission. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the permission via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+            }[];
         };
       };
     };
     responses: {
-      /** @description The configuration for an api */
+      /** @description Success */
       200: {
         content: {
-          "application/json": {
-            /**
-             * @description The id of the api
-             * @example api_134
-             */
-            apiId: string;
-          };
+          "application/json": Record<string, never>;
         };
       };
       /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
@@ -1446,30 +1651,58 @@ interface operations {
       };
     };
   };
-  listKeys: {
-    parameters: {
-      query: {
-        apiId: string;
-        limit?: number;
-        cursor?: string;
-        ownerId?: string;
-        decrypt?: boolean | null;
+  setPermissions: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
+          /**
+           * @description The permissions you want to set for this key. This overwrites all existing permissions.
+           *             Setting permissions requires the `rbac.*.add_permission_to_key` permission.
+           * @example [
+           *   {
+           *     "id": "perm_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   },
+           *   {
+           *     "name": "dns.record.delete",
+           *     "create": true
+           *   }
+           * ]
+           */
+          permissions: {
+              /** @description The id of the permission. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the permission via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+              /**
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *                 Autocreating permissions requires your root key to have the `rbac.*.create_permission` permission, otherwise the request will get rejected
+               */
+              create?: boolean;
+            }[];
+        };
       };
     };
     responses: {
-      /** @description The configuration for an api */
+      /** @description All currently connected permissions */
       200: {
         content: {
           "application/json": {
-            keys: components["schemas"]["Key"][];
-            /**
-             * @description The cursor to use for the next page of results, if no cursor is returned, there are no more results
-             * @example eyJrZXkiOiJrZXlfMTIzNCJ9
-             */
-            cursor?: string;
-            /** @description The total number of keys for this api */
-            total: number;
-          };
+              /**
+               * @description The id of the permission. This is used internally
+               * @example perm_123
+               */
+              id: string;
+              /**
+               * @description The name of the permission
+               * @example dns.record.create
+               */
+              name: string;
+            }[];
         };
       };
       /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
@@ -1516,23 +1749,58 @@ interface operations {
       };
     };
   };
-  deleteApi: {
+  addRoles: {
     requestBody: {
       content: {
         "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
           /**
-           * @description The id of the api to delete
-           * @example api_1234
+           * @description The roles you want to set for this key. This overwrites all existing roles.
+           *           Setting roles requires the `rbac.*.add_role_to_key` permission.
+           * @example [
+           *   {
+           *     "id": "role_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   },
+           *   {
+           *     "name": "dns.record.delete",
+           *     "create": true
+           *   }
+           * ]
            */
-          apiId: string;
+          roles: {
+              /** @description The id of the role. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the role via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+              /**
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *               Autocreating roles requires your root key to have the `rbac.*.create_role` permission, otherwise the request will get rejected
+               */
+              create?: boolean;
+            }[];
         };
       };
     };
     responses: {
-      /** @description The api was successfully deleted, it may take up to 30s for this to take effect in all regions */
+      /** @description All currently connected roles */
       200: {
         content: {
-          "application/json": Record<string, never>;
+          "application/json": {
+              /**
+               * @description The id of the role. This is used internally
+               * @example role_123
+               */
+              id: string;
+              /**
+               * @description The name of the role
+               * @example dns.record.create
+               */
+              name: string;
+            }[];
         };
       };
       /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
@@ -1579,31 +1847,37 @@ interface operations {
       };
     };
   };
-  deleteKeys: {
+  removeRoles: {
     requestBody: {
       content: {
         "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
           /**
-           * @description The id of the api, that the keys belong to.
-           * @example api_1234
-           */
-          apiId: string;
-          /**
-           * @description If true, the keys will be permanently deleted. If false, the keys will be soft-deleted and can be restored later.
-           * @default false
+           * @description The roles you want to remove from this key.
+           * @example [
+           *   {
+           *     "id": "role_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   }
+           * ]
            */
-          permanent?: boolean;
+          roles: {
+              /** @description The id of the role. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the role via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
+            }[];
         };
       };
     };
     responses: {
-      /** @description The keys have been deleted */
+      /** @description Success */
       200: {
         content: {
-          "application/json": {
-            /** @description The number of keys that were deleted */
-            deletedKeys: number;
-          };
+          "application/json": Record<string, never>;
         };
       };
       /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
@@ -1650,107 +1924,130 @@ interface operations {
       };
     };
   };
-  limit: {
+  setRoles: {
     requestBody: {
       content: {
         "application/json": {
+          /** @description The id of the key. */
+          keyId: string;
           /**
-           * @description Namespaces group different limits together for better analytics. You might have a namespace for your public API and one for internal tRPC routes.
-           * @default default
-           * @example email.outbound
+           * @description The roles you want to set for this key. This overwrites all existing roles.
+           *             Setting roles requires the `rbac.*.add_role_to_key` permission.
+           * @example [
+           *   {
+           *     "id": "role_123"
+           *   },
+           *   {
+           *     "name": "dns.record.create"
+           *   },
+           *   {
+           *     "name": "dns.record.delete",
+           *     "create": true
+           *   }
+           * ]
            */
-          namespace?: string;
-          /**
-           * @description Identifier of your user, this can be their userId, an email, an ip or anything else.
-           * @example user_123
-           */
-          identifier: string;
-          /**
-           * @description How many requests may pass in a given window.
-           * @example 10
-           */
-          limit: number;
-          /**
-           * @description The window duration in milliseconds
-           * @example 60000
-           */
-          duration: number;
-          /**
-           * @description Expensive requests may use up more tokens. You can specify a cost to the request here and we'll deduct this many tokens in the current window.
-           * If there are not enough tokens left, the request is denied.
-           *
-           * Set it to 0 to receive the current limit without changing anything.
-           * @default 1
-           * @example 2
-           */
-          cost?: number;
-          /**
-           * @description Async will return a response immediately, lowering latency at the cost of accuracy.
-           * @default false
-           */
-          async?: boolean;
-          /** @description Attach any metadata to this request */
-          meta?: {
-            [key: string]: unknown;
-          };
-          /**
-           * @description Resources that are about to be accessed by the user
-           * @example [
-           *   {
-           *     "type": "project",
-           *     "id": "p_123",
-           *     "name": "dub"
-           *   }
-           * ]
-           */
-          resources?: {
+          roles: {
+              /** @description The id of the role. Provide either `id` or `name`. If both are provided `id` is used. */
+              id?: string;
+              /** @description Identify the role via its name. Provide either `id` or `name`. If both are provided `id` is used. */
+              name?: string;
               /**
-               * @description The type of resource
-               * @example organization
+               * @description Set to true to automatically create the permissions they do not exist yet. Only works when specifying `name`.
+               *                 Autocreating roles requires your root key to have the `rbac.*.create_role` permission, otherwise the request will get rejected
                */
-              type: string;
+              create?: boolean;
+            }[];
+        };
+      };
+    };
+    responses: {
+      /** @description All currently connected roles */
+      200: {
+        content: {
+          "application/json": {
               /**
-               * @description The unique identifier for the resource
-               * @example org_123
+               * @description The id of the role. This is used internally
+               * @example role_123
                */
               id: string;
               /**
-               * @description A human readable name for this resource
-               * @example unkey
+               * @description The name of the role
+               * @example dns.record.create
                */
-              name?: string;
-              /** @description Attach any metadata to this resources */
-              meta?: {
-                [key: string]: unknown;
-              };
+              name: string;
             }[];
         };
       };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  getApi: {
+    parameters: {
+      query: {
+        apiId: string;
+      };
     };
     responses: {
+      /** @description The configuration for an api */
       200: {
         content: {
           "application/json": {
             /**
-             * @description Returns true if the request should be processed, false if it was rejected.
-             * @example true
-             */
-            success: boolean;
-            /**
-             * @description How many requests are allowed within a window.
-             * @example 10
+             * @description The id of the key
+             * @example key_1234
              */
-            limit: number;
+            id: string;
             /**
-             * @description How many requests can still be made in the current window.
-             * @example 9
+             * @description The id of the workspace that owns the api
+             * @example ws_1234
              */
-            remaining: number;
+            workspaceId: string;
             /**
-             * @description A unix millisecond timestamp when the limits reset.
-             * @example 1709804263654
+             * @description The name of the api. This is internal and your users will not see this.
+             * @example Unkey - Production
              */
-            reset: number;
+            name?: string;
           };
         };
       };
@@ -1798,171 +2095,1637 @@ interface operations {
       };
     };
   };
-  "v1.migrations.createKeys": {
+  createApi: {
     requestBody: {
       content: {
-        "application/json": ({
+        "application/json": {
+          /**
+           * @description The name for your API. This is not customer facing.
+           * @example my-api
+           */
+          name: string;
+        };
+      };
+    };
+    responses: {
+      /** @description The configuration for an api */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description Choose an `API` where this key should be created.
-             * @example api_123
+             * @description The id of the api
+             * @example api_134
              */
             apiId: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  listKeys: {
+    parameters: {
+      query: {
+        apiId: string;
+        limit?: number;
+        cursor?: string;
+        ownerId?: string;
+        externalId?: string;
+        decrypt?: boolean | null;
+      };
+    };
+    responses: {
+      /** @description The configuration for an api */
+      200: {
+        content: {
+          "application/json": {
+            keys: components["schemas"]["Key"][];
             /**
-             * @description To make it easier for your users to understand which product an api key belongs to, you can add prefix them.
-             *
-             * For example Stripe famously prefixes their customer ids with cus_ or their api keys with sk_live_.
-             *
-             * The underscore is automatically added if you are defining a prefix, for example: "prefix": "abc" will result in a key like abc_xxxxxxxxx
-             */
-            prefix?: string;
-            /**
-             * @description The name for your Key. This is not customer facing.
-             * @example my key
-             */
-            name?: string;
-            /** @description The raw key in plaintext. If provided, unkey encrypts this value and stores it securely. Provide either `hash` or `plaintext` */
-            plaintext?: string;
-            /** @description Provide either `hash` or `plaintext` */
-            hash?: {
-              /** @description The hashed and encoded key */
-              value: string;
-              /**
-               * @description The algorithm for hashing and encoding, currently only sha256 and base64 are supported
-               * @enum {string}
-               */
-              variant: "sha256_base64";
-            };
-            /**
-             * @description The first 4 characters of the key. If a prefix is used, it should be the prefix plus 4 characters.
-             * @example unkey_32kq
-             */
-            start?: string;
-            /**
-             * @description Your user’s Id. This will provide a link between Unkey and your customer record.
-             * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
-             * @example team_123
+             * @description The cursor to use for the next page of results, if no cursor is returned, there are no more results
+             * @example eyJrZXkiOiJrZXlfMTIzNCJ9
              */
-            ownerId?: string;
+            cursor?: string;
+            /** @description The total number of keys for this api */
+            total: number;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  deleteApi: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of the api to delete
+           * @example api_1234
+           */
+          apiId: string;
+        };
+      };
+    };
+    responses: {
+      /** @description The api was successfully deleted, it may take up to 30s for this to take effect in all regions */
+      200: {
+        content: {
+          "application/json": Record<string, never>;
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The api is protected from deletions */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrDeleteProtected"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  deleteKeys: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of the api, that the keys belong to.
+           * @example api_1234
+           */
+          apiId: string;
+          /**
+           * @description Delete the keys permanently, if false the keys will be marked as deleted but not removed from the database. In either case, the keys will no longer be valid when verifying them.
+           * @default false
+           */
+          permanent?: boolean;
+        };
+      };
+    };
+    responses: {
+      /** @description The keys have been deleted */
+      200: {
+        content: {
+          "application/json": {
+            /** @description The number of keys that were deleted */
+            deletedKeys: number;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  limit: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description Namespaces group different limits together for better analytics. You might have a namespace for your public API and one for internal tRPC routes.
+           * @default default
+           * @example email.outbound
+           */
+          namespace?: string;
+          /**
+           * @description Identifier of your user, this can be their userId, an email, an ip or anything else.
+           * @example user_123
+           */
+          identifier: string;
+          /**
+           * @description How many requests may pass in a given window.
+           * @example 10
+           */
+          limit: number;
+          /**
+           * @description The window duration in milliseconds
+           * @example 60000
+           */
+          duration: number;
+          /**
+           * @description Expensive requests may use up more tokens. You can specify a cost to the request here and we'll deduct this many tokens in the current window.
+           * If there are not enough tokens left, the request is denied.
+           *
+           * Set it to 0 to receive the current limit without changing anything.
+           * @default 1
+           * @example 2
+           */
+          cost?: number;
+          /**
+           * @description Async will return a response immediately, lowering latency at the cost of accuracy.
+           * @default false
+           */
+          async?: boolean;
+          /** @description Attach any metadata to this request */
+          meta?: {
+            [key: string]: unknown;
+          };
+          /**
+           * @description Resources that are about to be accessed by the user
+           * @example [
+           *   {
+           *     "type": "project",
+           *     "id": "p_123",
+           *     "name": "dub"
+           *   }
+           * ]
+           */
+          resources?: {
+              /**
+               * @description The type of resource
+               * @example organization
+               */
+              type: string;
+              /**
+               * @description The unique identifier for the resource
+               * @example org_123
+               */
+              id: string;
+              /**
+               * @description A human readable name for this resource
+               * @example unkey
+               */
+              name?: string;
+              /** @description Attach any metadata to this resources */
+              meta?: {
+                [key: string]: unknown;
+              };
+            }[];
+        };
+      };
+    };
+    responses: {
+      200: {
+        content: {
+          "application/json": {
+            /**
+             * @description Returns true if the request should be processed, false if it was rejected.
+             * @example true
+             */
+            success: boolean;
+            /**
+             * @description How many requests are allowed within a window.
+             * @example 10
+             */
+            limit: number;
+            /**
+             * @description How many requests can still be made in the current window.
+             * @example 9
+             */
+            remaining: number;
+            /**
+             * @description A unix millisecond timestamp when the limits reset.
+             * @example 1709804263654
+             */
+            reset: number;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  "v1.migrations.createKeys": {
+    requestBody: {
+      content: {
+        "application/json": ({
+            /**
+             * @description Choose an `API` where this key should be created.
+             * @example api_123
+             */
+            apiId: string;
+            /**
+             * @description To make it easier for your users to understand which product an api key belongs to, you can add prefix them.
+             *
+             * For example Stripe famously prefixes their customer ids with cus_ or their api keys with sk_live_.
+             *
+             * The underscore is automatically added if you are defining a prefix, for example: "prefix": "abc" will result in a key like abc_xxxxxxxxx
+             */
+            prefix?: string;
+            /**
+             * @description The name for your Key. This is not customer facing.
+             * @example my key
+             */
+            name?: string;
+            /** @description The raw key in plaintext. If provided, unkey encrypts this value and stores it securely. Provide either `hash` or `plaintext` */
+            plaintext?: string;
+            /** @description Provide either `hash` or `plaintext` */
+            hash?: {
+              /** @description The hashed and encoded key */
+              value: string;
+              /**
+               * @description The algorithm for hashing and encoding, currently only sha256 and base64 are supported
+               * @enum {string}
+               */
+              variant: "sha256_base64";
+            };
+            /**
+             * @description The first 4 characters of the key. If a prefix is used, it should be the prefix plus 4 characters.
+             * @example unkey_32kq
+             */
+            start?: string;
+            /**
+             * @description Your user’s Id. This will provide a link between Unkey and your customer record.
+             * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
+             * @example team_123
+             */
+            ownerId?: string;
+            /**
+             * @description This is a place for dynamic meta data, anything that feels useful for you should go here
+             * @example {
+             *   "billingTier": "PRO",
+             *   "trialEnds": "2023-06-16T17:16:37.161Z"
+             * }
+             */
+            meta?: {
+              [key: string]: unknown;
+            };
+            /**
+             * @description A list of roles that this key should have. If the role does not exist, an error is thrown
+             * @example [
+             *   "admin",
+             *   "finance"
+             * ]
+             */
+            roles?: string[];
+            /**
+             * @description A list of permissions that this key should have. If the permission does not exist, an error is thrown
+             * @example [
+             *   "domains.create_record",
+             *   "say_hello"
+             * ]
+             */
+            permissions?: string[];
+            /**
+             * @description You can auto expire keys by providing a unix timestamp in milliseconds. Once Keys expire they will automatically be disabled and are no longer valid unless you enable them again.
+             * @example 1623869797161
+             */
+            expires?: number;
+            /**
+             * @description You can limit the number of requests a key can make. Once a key reaches 0 remaining requests, it will automatically be disabled and is no longer valid unless you update it.
+             * @example 1000
+             */
+            remaining?: number;
+            /**
+             * @description Unkey enables you to refill verifications for each key at regular intervals.
+             * @example {
+             *   "interval": "daily",
+             *   "amount": 100
+             * }
+             */
+            refill?: {
+              /**
+               * @description Unkey will automatically refill verifications at the set interval.
+               * @enum {string}
+               */
+              interval: "daily" | "monthly";
+              /** @description The number of verifications to refill for each occurrence is determined individually for each key. */
+              amount: number;
+            };
+            /**
+             * @description Unkey comes with per-key ratelimiting out of the box.
+             * @example {
+             *   "type": "fast",
+             *   "limit": 10,
+             *   "refillRate": 1,
+             *   "refillInterval": 60
+             * }
+             */
+            ratelimit?: {
+              /**
+               * @description Async will return a response immediately, lowering latency at the cost of accuracy.
+               * @default false
+               */
+              async?: boolean;
+              /**
+               * @deprecated
+               * @description Fast ratelimiting doesn't add latency, while consistent ratelimiting is more accurate.
+               * @default fast
+               * @enum {string}
+               */
+              type?: "fast" | "consistent";
+              /** @description The total amount of burstable requests. */
+              limit: number;
+              /**
+               * @deprecated
+               * @description How many tokens to refill during each refillInterval.
+               */
+              refillRate: number;
+              /**
+               * @deprecated
+               * @description Determines the speed at which tokens are refilled, in milliseconds.
+               */
+              refillInterval: number;
+            };
+            /**
+             * @description Sets if key is enabled or disabled. Disabled keys are not valid.
+             * @default true
+             * @example false
+             */
+            enabled?: boolean;
+            /**
+             * @description Environments allow you to divide your keyspace.
+             *
+             * Some applications like Stripe, Clerk, WorkOS and others have a concept of "live" and "test" keys to
+             * give the developer a way to develop their own application without the risk of modifying real world
+             * resources.
+             *
+             * When you set an environment, we will return it back to you when validating the key, so you can
+             * handle it correctly.
+             */
+            environment?: string;
+          })[];
+      };
+    };
+    responses: {
+      /** @description The key ids of all created keys */
+      200: {
+        content: {
+          "application/json": {
+            /**
+             * @description The ids of the keys. This is not a secret and can be stored as a reference if you wish. You need the keyId to update or delete a key later.
+             * @example [
+             *   "key_123",
+             *   "key_456"
+             * ]
+             */
+            keyIds: string[];
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  "v1.migrations.enqueueKeys": {
+    requestBody: {
+      content: {
+        "application/json": {
+          /** @description Contact support@unkey.dev to receive your migration id. */
+          migrationId: string;
+          /** @description The id of the api, you want to migrate keys to */
+          apiId: string;
+          keys: ({
+              /**
+               * @description To make it easier for your users to understand which product an api key belongs to, you can add prefix them.
+               *
+               * For example Stripe famously prefixes their customer ids with cus_ or their api keys with sk_live_.
+               *
+               * The underscore is automatically added if you are defining a prefix, for example: "prefix": "abc" will result in a key like abc_xxxxxxxxx
+               */
+              prefix?: string;
+              /**
+               * @description The name for your Key. This is not customer facing.
+               * @example my key
+               */
+              name?: string;
+              /** @description The raw key in plaintext. If provided, unkey encrypts this value and stores it securely. Provide either `hash` or `plaintext` */
+              plaintext?: string;
+              /** @description Provide either `hash` or `plaintext` */
+              hash?: {
+                /** @description The hashed and encoded key */
+                value: string;
+                /**
+                 * @description The algorithm for hashing and encoding, currently only sha256 and base64 are supported
+                 * @enum {string}
+                 */
+                variant: "sha256_base64";
+              };
+              /**
+               * @description The first 4 characters of the key. If a prefix is used, it should be the prefix plus 4 characters.
+               * @example unkey_32kq
+               */
+              start?: string;
+              /**
+               * @description Your user’s Id. This will provide a link between Unkey and your customer record.
+               * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
+               * @example team_123
+               */
+              ownerId?: string;
+              /**
+               * @description This is a place for dynamic meta data, anything that feels useful for you should go here
+               * @example {
+               *   "billingTier": "PRO",
+               *   "trialEnds": "2023-06-16T17:16:37.161Z"
+               * }
+               */
+              meta?: {
+                [key: string]: unknown;
+              };
+              /**
+               * @description A list of roles that this key should have. If the role does not exist, an error is thrown
+               * @example [
+               *   "admin",
+               *   "finance"
+               * ]
+               */
+              roles?: string[];
+              /**
+               * @description A list of permissions that this key should have. If the permission does not exist, an error is thrown
+               * @example [
+               *   "domains.create_record",
+               *   "say_hello"
+               * ]
+               */
+              permissions?: string[];
+              /**
+               * @description You can auto expire keys by providing a unix timestamp in milliseconds. Once Keys expire they will automatically be disabled and are no longer valid unless you enable them again.
+               * @example 1623869797161
+               */
+              expires?: number;
+              /**
+               * @description You can limit the number of requests a key can make. Once a key reaches 0 remaining requests, it will automatically be disabled and is no longer valid unless you update it.
+               * @example 1000
+               */
+              remaining?: number;
+              /**
+               * @description Unkey enables you to refill verifications for each key at regular intervals.
+               * @example {
+               *   "interval": "daily",
+               *   "amount": 100
+               * }
+               */
+              refill?: {
+                /**
+                 * @description Unkey will automatically refill verifications at the set interval.
+                 * @enum {string}
+                 */
+                interval: "daily" | "monthly";
+                /** @description The number of verifications to refill for each occurrence is determined individually for each key. */
+                amount: number;
+              };
+              /**
+               * @description Unkey comes with per-key fixed-window ratelimiting out of the box.
+               * @example {
+               *   "type": "fast",
+               *   "limit": 10,
+               *   "duration": 60000
+               * }
+               */
+              ratelimit?: {
+                /**
+                 * @description Async will return a response immediately, lowering latency at the cost of accuracy.
+                 * @default true
+                 */
+                async?: boolean;
+                /**
+                 * @deprecated
+                 * @description Deprecated, use `async`. Fast ratelimiting doesn't add latency, while consistent ratelimiting is more accurate.
+                 * @default fast
+                 * @enum {string}
+                 */
+                type?: "fast" | "consistent";
+                /** @description The total amount of requests in a given interval. */
+                limit: number;
+                /**
+                 * @description The window duration in milliseconds
+                 * @example 60000
+                 */
+                duration: number;
+                /**
+                 * @deprecated
+                 * @description How many tokens to refill during each refillInterval.
+                 */
+                refillRate?: number;
+                /**
+                 * @deprecated
+                 * @description The refill timeframe, in milliseconds.
+                 */
+                refillInterval?: number;
+              };
+              /**
+               * @description Sets if key is enabled or disabled. Disabled keys are not valid.
+               * @default true
+               * @example false
+               */
+              enabled?: boolean;
+              /**
+               * @description Environments allow you to divide your keyspace.
+               *
+               * Some applications like Stripe, Clerk, WorkOS and others have a concept of "live" and "test" keys to
+               * give the developer a way to develop their own application without the risk of modifying real world
+               * resources.
+               *
+               * When you set an environment, we will return it back to you when validating the key, so you can
+               * handle it correctly.
+               */
+              environment?: string;
+            })[];
+        };
+      };
+    };
+    responses: {
+      /** @description The key ids of all created keys */
+      202: {
+        content: {
+          "application/json": Record<string, never>;
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  createPermission: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The unique name of your permission.
+           * @example record.write
+           */
+          name: string;
+          /**
+           * @description Explain what this permission does. This is just for your team, your users will not see this.
+           * @example record.write can create new dns records for our domains.
+           */
+          description?: string;
+        };
+      };
+    };
+    responses: {
+      /** @description Sucessfully created a permission */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description This is a place for dynamic meta data, anything that feels useful for you should go here
-             * @example {
-             *   "billingTier": "PRO",
-             *   "trialEnds": "2023-06-16T17:16:37.161Z"
-             * }
+             * @description The id of the permission. This is used internally
+             * @example perm_123
              */
-            meta?: {
-              [key: string]: unknown;
-            };
+            permissionId: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  deletePermission: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of the permission you want to delete.
+           * @example perm_123
+           */
+          permissionId: string;
+        };
+      };
+    };
+    responses: {
+      /** @description Sucessfully deleted a permission */
+      200: {
+        content: {
+          "application/json": Record<string, never>;
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  getPermission: {
+    parameters: {
+      query: {
+        permissionId: string;
+      };
+    };
+    responses: {
+      /** @description The Role */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description A list of roles that this key should have. If the role does not exist, an error is thrown
-             * @example [
-             *   "admin",
-             *   "finance"
-             * ]
+             * @description The id of the permission
+             * @example perm_123
              */
-            roles?: string[];
+            id: string;
+            /**
+             * @description The name of the permission.
+             * @example domain.record.manager
+             */
+            name: string;
+            /**
+             * @description The description of what this permission does. This is just for your team, your users will not see this.
+             * @example Can manage dns records
+             */
+            description?: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  listPermissions: {
+    responses: {
+      /** @description The permissions in your workspace */
+      200: {
+        content: {
+          "application/json": {
+              /**
+               * @description The id of the permission
+               * @example perm_123
+               */
+              id: string;
+              /**
+               * @description The name of the permission.
+               * @example domain.record.manager
+               */
+              name: string;
+              /**
+               * @description The description of what this permission does. This is just for your team, your users will not see this.
+               * @example Can manage dns records
+               */
+              description?: string;
+            }[];
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  createRole: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The unique name of your role.
+           * @example dns.records.manager
+           */
+          name: string;
+          /**
+           * @description Explain what this role does. This is just for your team, your users will not see this.
+           * @example dns.records.manager can read and write dns records for our domains.
+           */
+          description?: string;
+        };
+      };
+    };
+    responses: {
+      /** @description Sucessfully created a role */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description A list of permissions that this key should have. If the permission does not exist, an error is thrown
-             * @example [
-             *   "domains.create_record",
-             *   "say_hello"
-             * ]
+             * @description The id of the role. This is used internally
+             * @example role_123
              */
-            permissions?: string[];
+            roleId: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  deleteRole: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of the role you want to delete.
+           * @example role_123
+           */
+          roleId: string;
+        };
+      };
+    };
+    responses: {
+      /** @description Sucessfully deleted a role */
+      200: {
+        content: {
+          "application/json": Record<string, never>;
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  getRole: {
+    parameters: {
+      query: {
+        roleId: string;
+      };
+    };
+    responses: {
+      /** @description The Role */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description You can auto expire keys by providing a unix timestamp in milliseconds. Once Keys expire they will automatically be disabled and are no longer valid unless you enable them again.
-             * @example 1623869797161
+             * @description The id of the role
+             * @example role_1234
              */
-            expires?: number;
+            id: string;
             /**
-             * @description You can limit the number of requests a key can make. Once a key reaches 0 remaining requests, it will automatically be disabled and is no longer valid unless you update it.
-             * @example 1000
+             * @description The name of the role.
+             * @example domain.record.manager
              */
-            remaining?: number;
+            name: string;
             /**
-             * @description Unkey enables you to refill verifications for each key at regular intervals.
-             * @example {
-             *   "interval": "daily",
-             *   "amount": 100
-             * }
+             * @description The description of what this role does. This is just for your team, your users will not see this.
+             * @example Can manage dns records
              */
-            refill?: {
+            description?: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  listRoles: {
+    responses: {
+      /** @description The Roles in your workspace */
+      200: {
+        content: {
+          "application/json": {
               /**
-               * @description Unkey will automatically refill verifications at the set interval.
-               * @enum {string}
+               * @description The id of the role
+               * @example role_1234
                */
-              interval: "daily" | "monthly";
-              /** @description The number of verifications to refill for each occurrence is determined individually for each key. */
-              amount: number;
-            };
-            /**
-             * @description Unkey comes with per-key ratelimiting out of the box.
-             * @example {
-             *   "type": "fast",
-             *   "limit": 10,
-             *   "refillRate": 1,
-             *   "refillInterval": 60
-             * }
-             */
-            ratelimit?: {
+              id: string;
               /**
-               * @description Async will return a response immediately, lowering latency at the cost of accuracy.
-               * @default false
+               * @description The name of the role.
+               * @example domain.record.manager
                */
-              async?: boolean;
+              name: string;
               /**
-               * @deprecated
-               * @description Fast ratelimiting doesn't add latency, while consistent ratelimiting is more accurate.
-               * @default fast
-               * @enum {string}
+               * @description The description of what this role does. This is just for your team, your users will not see this.
+               * @example Can manage dns records
                */
-              type?: "fast" | "consistent";
-              /** @description The total amount of burstable requests. */
-              limit: number;
+              description?: string;
+            }[];
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  createIdentity: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of this identity in your system.
+           *
+           * This usually comes from your authentication provider and could be a userId, organisationId or even an email.
+           * It does not matter what you use, as long as it uniquely identifies something in your application.
+           *
+           * @example user_123
+           */
+          externalId: string;
+          /**
+           * @description Attach metadata to this identity that you need to have access to when verifying a key.
+           *
+           * This will be returned as part of the `verifyKey` response.
+           */
+          meta?: {
+            [key: string]: unknown;
+          };
+          /**
+           * @description Attach ratelimits to this identity.
+           *
+           * When verifying keys, you can specify which limits you want to use and all keys attached to this identity, will share the limits.
+           */
+          ratelimits?: {
               /**
-               * @deprecated
-               * @description How many tokens to refill during each refillInterval.
+               * @description The name of this limit. You will need to use this again when verifying a key.
+               * @example tokens
                */
-              refillRate: number;
+              name: string;
               /**
-               * @deprecated
-               * @description Determines the speed at which tokens are refilled, in milliseconds.
+               * @description How many requests may pass within a given window before requests are rejected.
+               * @example 10
                */
-              refillInterval: number;
-            };
-            /**
-             * @description Sets if key is enabled or disabled. Disabled keys are not valid.
-             * @default true
-             * @example false
-             */
-            enabled?: boolean;
+              limit: number;
+              /**
+               * @description The duration for each ratelimit window in milliseconds.
+               * @example 1000
+               */
+              duration: number;
+            }[];
+        };
+      };
+    };
+    responses: {
+      /** @description The configuration for an api */
+      200: {
+        content: {
+          "application/json": {
             /**
-             * @description Environments allow you to divide your keyspace.
-             *
-             * Some applications like Stripe, Clerk, WorkOS and others have a concept of "live" and "test" keys to
-             * give the developer a way to develop their own application without the risk of modifying real world
-             * resources.
-             *
-             * When you set an environment, we will return it back to you when validating the key, so you can
-             * handle it correctly.
+             * @description The id of the identity. Used internally, you do not need to store this.
+             * @example id_123
              */
-            environment?: string;
-          })[];
+            identityId: string;
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  getIdentity: {
+    parameters: {
+      query?: {
+        identityId?: string;
+        externalId?: string;
+      };
+    };
+    responses: {
+      /** @description The configuration for an api */
+      200: {
+        content: {
+          "application/json": {
+            /** @description The id of this identity. Used to interact with unkey's API */
+            id: string;
+            /** @description The id in your system */
+            externalId: string;
+            /** @description The meta object defined for this identity. */
+            meta: {
+              [key: string]: unknown;
+            };
+            /** @description When verifying keys, you can specify which limits you want to use and all keys attached to this identity, will share the limits. */
+            ratelimits: {
+                /**
+                 * @description The name of this limit. You will need to use this again when verifying a key.
+                 * @example tokens
+                 */
+                name: string;
+                /**
+                 * @description How many requests may pass within a given window before requests are rejected.
+                 * @example 10
+                 */
+                limit: number;
+                /**
+                 * @description The duration for each ratelimit window in milliseconds.
+                 * @example 1000
+                 */
+                duration: number;
+              }[];
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  listIdentities: {
+    parameters: {
+      query?: {
+        environment?: string;
+        limit?: number;
+        cursor?: string;
       };
     };
     responses: {
-      /** @description The key ids of all created keys */
+      /** @description A list of identities. */
       200: {
         content: {
           "application/json": {
+            /** @description A list of identities. */
+            identities: {
+                /** @description The id of this identity. Used to interact with unkey's API */
+                id: string;
+                /** @description The id in your system */
+                externalId: string;
+                /** @description When verifying keys, you can specify which limits you want to use and all keys attached to this identity, will share the limits. */
+                ratelimits: {
+                    /**
+                     * @description The name of this limit. You will need to use this again when verifying a key.
+                     * @example tokens
+                     */
+                    name: string;
+                    /**
+                     * @description How many requests may pass within a given window before requests are rejected.
+                     * @example 10
+                     */
+                    limit: number;
+                    /**
+                     * @description The duration for each ratelimit window in milliseconds.
+                     * @example 1000
+                     */
+                    duration: number;
+                  }[];
+              }[];
             /**
-             * @description The ids of the keys. This is not a secret and can be stored as a reference if you wish. You need the keyId to update or delete a key later.
-             * @example [
-             *   "key_123",
-             *   "key_456"
-             * ]
+             * @description The cursor to use for the next page of results, if no cursor is returned, there are no more results
+             * @example eyJrZXkiOiJrZXlfMTIzNCJ9
              */
-            keyIds: string[];
+            cursor?: string;
+            /** @description The total number of identities for this environment */
+            total: number;
           };
         };
       };
@@ -2010,166 +3773,166 @@ interface operations {
       };
     };
   };
-  "v1.migrations.enqueueKeys": {
+  updateIdentity: {
     requestBody: {
       content: {
         "application/json": {
-          /** @description Contact support@unkey.dev to receive your migration id. */
-          migrationId: string;
-          /** @description The id of the api, you want to migrate keys to */
-          apiId: string;
-          keys: ({
-              /**
-               * @description To make it easier for your users to understand which product an api key belongs to, you can add prefix them.
-               *
-               * For example Stripe famously prefixes their customer ids with cus_ or their api keys with sk_live_.
-               *
-               * The underscore is automatically added if you are defining a prefix, for example: "prefix": "abc" will result in a key like abc_xxxxxxxxx
-               */
-              prefix?: string;
-              /**
-               * @description The name for your Key. This is not customer facing.
-               * @example my key
-               */
-              name?: string;
-              /** @description The raw key in plaintext. If provided, unkey encrypts this value and stores it securely. Provide either `hash` or `plaintext` */
-              plaintext?: string;
-              /** @description Provide either `hash` or `plaintext` */
-              hash?: {
-                /** @description The hashed and encoded key */
-                value: string;
-                /**
-                 * @description The algorithm for hashing and encoding, currently only sha256 and base64 are supported
-                 * @enum {string}
-                 */
-                variant: "sha256_base64";
-              };
-              /**
-               * @description The first 4 characters of the key. If a prefix is used, it should be the prefix plus 4 characters.
-               * @example unkey_32kq
-               */
-              start?: string;
-              /**
-               * @description Your user’s Id. This will provide a link between Unkey and your customer record.
-               * When validating a key, we will return this back to you, so you can clearly identify your user from their api key.
-               * @example team_123
-               */
-              ownerId?: string;
-              /**
-               * @description This is a place for dynamic meta data, anything that feels useful for you should go here
-               * @example {
-               *   "billingTier": "PRO",
-               *   "trialEnds": "2023-06-16T17:16:37.161Z"
-               * }
-               */
-              meta?: {
-                [key: string]: unknown;
-              };
-              /**
-               * @description A list of roles that this key should have. If the role does not exist, an error is thrown
-               * @example [
-               *   "admin",
-               *   "finance"
-               * ]
-               */
-              roles?: string[];
+          /**
+           * @description The id of the identity to update, use either `identityId` or `externalId`, if both are provided, `identityId` takes precedence.
+           * @example id_1234
+           */
+          identityId?: string;
+          /**
+           * @description The externalId of the identity to update, use either `identityId` or `externalId`, if both are provided, `identityId` takes precedence.
+           * @example user_1234
+           */
+          externalId?: string;
+          /**
+           * @description This is not yet used but here for future compatibility.
+           * @default default
+           */
+          environment?: string;
+          /**
+           * @description Attach metadata to this identity that you need to have access to when verifying a key.
+           *
+           * Set to `{}` to clear.
+           *
+           * This will be returned as part of the `verifyKey` response.
+           */
+          meta?: {
+            [key: string]: unknown;
+          };
+          /**
+           * @description Attach ratelimits to this identity.
+           *
+           * This overwrites all existing ratelimits on this identity.
+           * Setting an empty array will delete all existing ratelimits.
+           *
+           * When verifying keys, you can specify which limits you want to use and all keys attached to this identity, will share the limits.
+           */
+          ratelimits?: {
               /**
-               * @description A list of permissions that this key should have. If the permission does not exist, an error is thrown
-               * @example [
-               *   "domains.create_record",
-               *   "say_hello"
-               * ]
+               * @description The name of this limit. You will need to use this again when verifying a key.
+               * @example tokens
                */
-              permissions?: string[];
+              name: string;
               /**
-               * @description You can auto expire keys by providing a unix timestamp in milliseconds. Once Keys expire they will automatically be disabled and are no longer valid unless you enable them again.
-               * @example 1623869797161
+               * @description How many requests may pass within a given window before requests are rejected.
+               * @example 10
                */
-              expires?: number;
+              limit: number;
               /**
-               * @description You can limit the number of requests a key can make. Once a key reaches 0 remaining requests, it will automatically be disabled and is no longer valid unless you update it.
+               * @description The duration for each ratelimit window in milliseconds.
                * @example 1000
                */
-              remaining?: number;
-              /**
-               * @description Unkey enables you to refill verifications for each key at regular intervals.
-               * @example {
-               *   "interval": "daily",
-               *   "amount": 100
-               * }
-               */
-              refill?: {
-                /**
-                 * @description Unkey will automatically refill verifications at the set interval.
-                 * @enum {string}
-                 */
-                interval: "daily" | "monthly";
-                /** @description The number of verifications to refill for each occurrence is determined individually for each key. */
-                amount: number;
-              };
-              /**
-               * @description Unkey comes with per-key fixed-window ratelimiting out of the box.
-               * @example {
-               *   "type": "fast",
-               *   "limit": 10,
-               *   "duration": 60000
-               * }
-               */
-              ratelimit?: {
+              duration: number;
+            }[];
+        };
+      };
+    };
+    responses: {
+      /** @description The identity after the update. */
+      200: {
+        content: {
+          "application/json": {
+            /**
+             * @description The id of the identity.
+             * @example id_1234
+             */
+            id: string;
+            /**
+             * @description The externalId of the identity.
+             * @example user_1234
+             */
+            externalId: string;
+            /**
+             * @description The metadata attached to this identity.
+             * @example {
+             *   "stripeSubscriptionId": "sub_1234"
+             * }
+             */
+            meta: {
+              [key: string]: unknown;
+            };
+            ratelimits: {
                 /**
-                 * @description Async will return a response immediately, lowering latency at the cost of accuracy.
-                 * @default true
+                 * @description The name of this limit.
+                 * @example tokens
                  */
-                async?: boolean;
+                name: string;
                 /**
-                 * @deprecated
-                 * @description Deprecated, use `async`. Fast ratelimiting doesn't add latency, while consistent ratelimiting is more accurate.
-                 * @default fast
-                 * @enum {string}
+                 * @description How many requests may pass within a given window before requests are rejected.
+                 * @example 10
                  */
-                type?: "fast" | "consistent";
-                /** @description The total amount of requests in a given interval. */
                 limit: number;
                 /**
-                 * @description The window duration in milliseconds
-                 * @example 60000
+                 * @description The duration for each ratelimit window in milliseconds.
+                 * @example 1000
                  */
                 duration: number;
-                /**
-                 * @deprecated
-                 * @description How many tokens to refill during each refillInterval.
-                 */
-                refillRate?: number;
-                /**
-                 * @deprecated
-                 * @description The refill timeframe, in milliseconds.
-                 */
-                refillInterval?: number;
-              };
-              /**
-               * @description Sets if key is enabled or disabled. Disabled keys are not valid.
-               * @default true
-               * @example false
-               */
-              enabled?: boolean;
-              /**
-               * @description Environments allow you to divide your keyspace.
-               *
-               * Some applications like Stripe, Clerk, WorkOS and others have a concept of "live" and "test" keys to
-               * give the developer a way to develop their own application without the risk of modifying real world
-               * resources.
-               *
-               * When you set an environment, we will return it back to you when validating the key, so you can
-               * handle it correctly.
-               */
-              environment?: string;
-            })[];
+              }[];
+          };
+        };
+      };
+      /** @description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). */
+      400: {
+        content: {
+          "application/json": components["schemas"]["ErrBadRequest"];
+        };
+      };
+      /** @description Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. */
+      401: {
+        content: {
+          "application/json": components["schemas"]["ErrUnauthorized"];
+        };
+      };
+      /** @description The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client's identity is known to the server. */
+      403: {
+        content: {
+          "application/json": components["schemas"]["ErrForbidden"];
+        };
+      };
+      /** @description The server cannot find the requested resource. In the browser, this means the URL is not recognized. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 Forbidden to hide the existence of a resource from an unauthorized client. This response code is probably the most well known due to its frequent occurrence on the web. */
+      404: {
+        content: {
+          "application/json": components["schemas"]["ErrNotFound"];
+        };
+      };
+      /** @description This response is sent when a request conflicts with the current state of the server. */
+      409: {
+        content: {
+          "application/json": components["schemas"]["ErrConflict"];
+        };
+      };
+      /** @description The user has sent too many requests in a given amount of time ("rate limiting") */
+      429: {
+        content: {
+          "application/json": components["schemas"]["ErrTooManyRequests"];
+        };
+      };
+      /** @description The server has encountered a situation it does not know how to handle. */
+      500: {
+        content: {
+          "application/json": components["schemas"]["ErrInternalServerError"];
+        };
+      };
+    };
+  };
+  deleteIdentity: {
+    requestBody: {
+      content: {
+        "application/json": {
+          /**
+           * @description The id of the identity to delete
+           * @example id_1234
+           */
+          identityId: string;
         };
       };
     };
     responses: {
-      /** @description The key ids of all created keys */
-      202: {
+      /** @description The identity was successfully deleted, it may take up to 30s for this to take effect in all regions */
+      200: {
         content: {
           "application/json": Record<string, never>;
         };
@@ -2422,11 +4185,6 @@ interface operations {
              * @example 0
              */
             createdAt?: number;
-            /**
-             * @description The unix timestamp in milliseconds when the key was deleted. We don't delete the key outright, you can restore it later.
-             * @example 0
-             */
-            deletedAt?: number;
             /**
              * @description The unix timestamp in milliseconds when the key will expire. If this field is null or undefined, the key is not expiring.
              * @example 123
@@ -2474,7 +4232,7 @@ interface operations {
              * @example NOT_FOUND
              * @enum {string}
              */
-            code?: "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS";
+            code?: "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS" | "EXPIRED";
           };
         };
       };
@@ -2744,10 +4502,17 @@ declare function verifyKey(req: string | {
             reset: number;
         };
         remaining?: number;
-        code: "VALID" | "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS";
+        code: "VALID" | "NOT_FOUND" | "FORBIDDEN" | "USAGE_EXCEEDED" | "RATE_LIMITED" | "UNAUTHORIZED" | "DISABLED" | "INSUFFICIENT_PERMISSIONS" | "EXPIRED";
         enabled?: boolean;
         permissions?: string[];
         environment?: string;
+        identity?: {
+            id: string;
+            externalId: string;
+            meta: {
+                [key: string]: unknown;
+            };
+        };
     };
     error?: never;
 }>;