@widgetic/api-sdk 1.0.27 → 1.0.29

package/dist/apis/PromptsApi.d.ts

@@ -14,6 +14,7 @@ import type { CreatePromptRequest, GetAllPrompts200Response, Prompt, UpdatePromp
 export interface CreatePromptOperationRequest {
     userId: string;
     createPromptRequest: CreatePromptRequest;
+    idempotencyKey?: string;
 }
 export interface DeletePromptRequest {
     userId: string;
@@ -33,6 +34,7 @@ export interface UpdatePromptOperationRequest {
     userId: string;
     id: number;
     updatePromptRequest: UpdatePromptRequest;
+    idempotencyKey?: string;
 }
 /**
  *

package/dist/apis/PromptsApi.js

@@ -44,6 +44,9 @@ class PromptsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -215,6 +218,9 @@ class PromptsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);

package/dist/apis/SubscriptionsApi.d.ts

@@ -13,6 +13,7 @@ import * as runtime from '../runtime';
 import type { GetBillingReports200ResponseInner, MoveSubscriptionSurfaceRequest, NewSubscription, ProcessRefund200Response, RefundRequest, Subscription, SubscriptionsIdRefundPreviewPost200Response, SubscriptionsIdRefundPreviewPostRequest, UpdateSubscription } from '../models/index';
 export interface CreateSubscriptionRequest {
     newSubscription: NewSubscription;
+    idempotencyKey?: string;
 }
 export interface DeleteSubscriptionRequest {
     id: string;
@@ -38,9 +39,11 @@ export interface GetSubscriptionsByUserIdRequest {
 export interface MoveSubscriptionSurfaceOperationRequest {
     id: string;
     moveSubscriptionSurfaceRequest: MoveSubscriptionSurfaceRequest;
+    idempotencyKey?: string;
 }
 export interface ProcessRefundRequest {
     id: string;
+    idempotencyKey?: string;
     refundRequest?: RefundRequest;
 }
 export interface SubscriptionsIdRefundPreviewPostOperationRequest {
@@ -50,6 +53,7 @@ export interface SubscriptionsIdRefundPreviewPostOperationRequest {
 export interface UpdateSubscriptionRequest {
     id: string;
     updateSubscription: UpdateSubscription;
+    idempotencyKey?: string;
 }
 /**
  *

package/dist/apis/SubscriptionsApi.js

@@ -41,6 +41,9 @@ class SubscriptionsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -285,6 +288,9 @@ class SubscriptionsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -323,6 +329,9 @@ class SubscriptionsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -404,6 +413,9 @@ class SubscriptionsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);

package/dist/apis/TranslationsApi.d.ts

@@ -14,9 +14,11 @@ import type { AddLanguagesToTranslation200Response, AddLanguagesToTranslationReq
 export interface AddLanguagesToTranslationOperationRequest {
     id: string;
     addLanguagesToTranslationRequest: AddLanguagesToTranslationRequest;
+    idempotencyKey?: string;
 }
 export interface CreateTranslationOperationRequest {
     createTranslationRequest: CreateTranslationRequest;
+    idempotencyKey?: string;
 }
 export interface DeleteTranslationRequest {
     id: string;
@@ -40,15 +42,18 @@ export interface RemoveLanguageFromTranslationRequest {
 }
 export interface RetranslateExperimentOperationRequest {
     id: string;
+    idempotencyKey?: string;
     retranslateExperimentRequest?: RetranslateExperimentRequest;
 }
 export interface SubmitTranslationAnalyticsEventOperationRequest {
     id: string;
     submitTranslationAnalyticsEventRequest: SubmitTranslationAnalyticsEventRequest;
+    idempotencyKey?: string;
 }
 export interface UpdateTranslationStatusOperationRequest {
     id: string;
     updateTranslationStatusRequest: UpdateTranslationStatusRequest;
+    idempotencyKey?: string;
 }
 /**
  *

package/dist/apis/TranslationsApi.js

@@ -44,6 +44,9 @@ class TranslationsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("BearerAuth", []);
@@ -83,6 +86,9 @@ class TranslationsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("BearerAuth", []);
@@ -397,6 +403,9 @@ class TranslationsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("BearerAuth", []);
@@ -439,6 +448,9 @@ class TranslationsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             const response = yield this.request({
                 path: `/translations/{id}/analytics/events`.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id']))),
                 method: 'POST',
@@ -473,6 +485,9 @@ class TranslationsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("BearerAuth", []);

package/dist/apis/UploadsApi.d.ts

@@ -74,12 +74,12 @@ export declare class UploadsApi extends runtime.BaseAPI {
      */
     uploadsPost(requestParameters: UploadsPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Upload>;
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id` and `conversation_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePostRaw(requestParameters: UploadsTusIdCompletePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Upload>>;
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id` and `conversation_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePost(requestParameters: UploadsTusIdCompletePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Upload>;

package/dist/apis/UploadsApi.js

@@ -212,7 +212,7 @@ class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id` and `conversation_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePostRaw(requestParameters, initOverrides) {
@@ -232,7 +232,7 @@ class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id` and `conversation_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePost(requestParameters, initOverrides) {

package/dist/apis/UsageApi.d.ts

@@ -12,6 +12,7 @@
 import * as runtime from '../runtime';
 export interface BulkRecordUsageRequest {
     body: object;
+    idempotencyKey?: string;
 }
 export interface GetAllUsageRequest {
     userId?: string;
@@ -44,6 +45,7 @@ export interface GetUserUsageSummaryRequest {
 }
 export interface RecordUsageRequest {
     body: object;
+    idempotencyKey?: string;
 }
 /**
  *

package/dist/apis/UsageApi.js

@@ -40,6 +40,9 @@ class UsageApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -306,6 +309,9 @@ class UsageApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);

package/dist/apis/UsersApi.d.ts

@@ -18,6 +18,7 @@ export interface AddPersonalWorkspaceDomainRequest {
 export interface CreateUserApiKeyOperationRequest {
     id: string;
     createUserApiKeyRequest: CreateUserApiKeyRequest;
+    idempotencyKey?: string;
 }
 export interface DeletePersonalWorkspaceDomainRequest {
     id: string;
@@ -56,22 +57,22 @@ export interface UsersSendFeedbackPostOperationRequest {
  */
 export declare class UsersApi extends runtime.BaseAPI {
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. To test on your own machine, add `localhost`. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomainRaw(requestParameters: AddPersonalWorkspaceDomainRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PersonalWorkspaceDomainResult>>;
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. To test on your own machine, add `localhost`. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomain(requestParameters: AddPersonalWorkspaceDomainRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PersonalWorkspaceDomainResult>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
      * Create an API key
      */
     createUserApiKeyRaw(requestParameters: CreateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreatedUserApiKey>>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
      * Create an API key
      */
     createUserApiKey(requestParameters: CreateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreatedUserApiKey>;
@@ -126,12 +127,12 @@ export declare class UsersApi extends runtime.BaseAPI {
      */
     getUserApiKeyUsageLogs(requestParameters: GetUserApiKeyUsageLogsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetUserApiKeyUsageLogs200Response>;
     /**
-     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used and whether it is switched on. The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
+     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
      * List the API keys of an account
      */
     getUserApiKeysRaw(requestParameters: GetUserApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetUserApiKeys200Response>>;
     /**
-     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used and whether it is switched on. The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
+     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
      * List the API keys of an account
      */
     getUserApiKeys(requestParameters: GetUserApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetUserApiKeys200Response>;
@@ -146,12 +147,12 @@ export declare class UsersApi extends runtime.BaseAPI {
      */
     updatePersonalWorkspaceDomain(requestParameters: UpdatePersonalWorkspaceDomainRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PersonalWorkspaceDomainResult>;
     /**
-     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret and the expiry of a key cannot be changed. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
+     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret, the expiry and the scopes of a key cannot be changed. Only a key with full access can make these requests: a key limited to some scopes is refused with 403 and the code `API_KEY_SCOPE_MISSING`. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
      * Rename an API key, or switch it off or on
      */
     updateUserApiKeyRaw(requestParameters: UpdateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<UserApiKey>>;
     /**
-     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret and the expiry of a key cannot be changed. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
+     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret, the expiry and the scopes of a key cannot be changed. Only a key with full access can make these requests: a key limited to some scopes is refused with 403 and the code `API_KEY_SCOPE_MISSING`. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
      * Rename an API key, or switch it off or on
      */
     updateUserApiKey(requestParameters: UpdateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<UserApiKey>;

package/dist/apis/UsersApi.js

@@ -30,7 +30,7 @@ const index_1 = require("../models/index");
  */
 class UsersApi extends runtime.BaseAPI {
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. To test on your own machine, add `localhost`. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomainRaw(requestParameters, initOverrides) {
@@ -62,7 +62,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. To test on your own machine, add `localhost`. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomain(requestParameters, initOverrides) {
@@ -72,7 +72,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
      * Create an API key
      */
     createUserApiKeyRaw(requestParameters, initOverrides) {
@@ -86,6 +86,9 @@ class UsersApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("apiKeyAuth", []);
@@ -104,7 +107,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
      * Create an API key
      */
     createUserApiKey(requestParameters, initOverrides) {
@@ -307,7 +310,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used and whether it is switched on. The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
+     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
      * List the API keys of an account
      */
     getUserApiKeysRaw(requestParameters, initOverrides) {
@@ -334,7 +337,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used and whether it is switched on. The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
+     * Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account\'s keys; Widgetic staff can list any account\'s.
      * List the API keys of an account
      */
     getUserApiKeys(requestParameters, initOverrides) {
@@ -389,7 +392,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret and the expiry of a key cannot be changed. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
+     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret, the expiry and the scopes of a key cannot be changed. Only a key with full access can make these requests: a key limited to some scopes is refused with 403 and the code `API_KEY_SCOPE_MISSING`. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
      * Rename an API key, or switch it off or on
      */
     updateUserApiKeyRaw(requestParameters, initOverrides) {
@@ -424,7 +427,7 @@ class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret and the expiry of a key cannot be changed. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
+     * Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret, the expiry and the scopes of a key cannot be changed. Only a key with full access can make these requests: a key limited to some scopes is refused with 403 and the code `API_KEY_SCOPE_MISSING`. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
      * Rename an API key, or switch it off or on
      */
     updateUserApiKey(requestParameters, initOverrides) {

package/dist/apis/WebhooksApi.d.ts

@@ -14,9 +14,11 @@ import type { HandleMarketplaceWebhook200Response, HandleTriggerDevUploadComplet
 export interface HandleMarketplaceWebhookRequest {
     marketplace: string;
     body: object;
+    idempotencyKey?: string;
 }
 export interface HandleTriggerDevUploadCompleteOperationRequest {
     handleTriggerDevUploadCompleteRequest: HandleTriggerDevUploadCompleteRequest;
+    idempotencyKey?: string;
 }
 /**
  *

package/dist/apis/WebhooksApi.js

@@ -44,6 +44,9 @@ class WebhooksApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             const response = yield this.request({
                 path: `/webhooks/marketplace/{marketplace}`.replace(`{${"marketplace"}}`, encodeURIComponent(String(requestParameters['marketplace']))),
                 method: 'POST',
@@ -76,6 +79,9 @@ class WebhooksApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             const response = yield this.request({
                 path: `/webhooks/triggerdev/upload-complete`,
                 method: 'POST',

package/dist/apis/WidgetsApi.d.ts

@@ -15,8 +15,8 @@ export interface CheckWidgetAccessRequest {
     id: string;
 }
 export interface CreateWidgetRequest {
-    idempotencyKey: string;
     newWidget: NewWidget;
+    idempotencyKey?: string;
 }
 export interface DeleteWidgetOperationRequest {
     id: string;
@@ -27,6 +27,7 @@ export interface DetachWidgetRequest {
 }
 export interface DuplicateWidgetOperationRequest {
     id: string;
+    idempotencyKey?: string;
     duplicateWidgetRequest?: DuplicateWidgetRequest;
 }
 export interface GetWidgetContentSchemaRequest {

package/dist/apis/WidgetsApi.js

@@ -72,9 +72,6 @@ class WidgetsApi extends runtime.BaseAPI {
      */
     createWidgetRaw(requestParameters, initOverrides) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (requestParameters['idempotencyKey'] == null) {
-                throw new runtime.RequiredError('idempotencyKey', 'Required parameter "idempotencyKey" was null or undefined when calling createWidget().');
-            }
             if (requestParameters['newWidget'] == null) {
                 throw new runtime.RequiredError('newWidget', 'Required parameter "newWidget" was null or undefined when calling createWidget().');
             }
@@ -204,6 +201,9 @@ class WidgetsApi extends runtime.BaseAPI {
             const queryParameters = {};
             const headerParameters = {};
             headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
             if (this.configuration && this.configuration.accessToken) {
                 const token = this.configuration.accessToken;
                 const tokenString = yield token("bearerAuth", []);

package/dist/apis/WorkspacesApi.d.ts

@@ -18,6 +18,7 @@ export interface CheckWorkspaceABTestAutoStop0Request {
 export interface CreateWorkspaceABTest0Request {
     workspaceId: string;
     createABTestRequest: CreateABTestRequest;
+    idempotencyKey?: string;
 }
 export interface DeleteWorkspaceABTest0Request {
     workspaceId: string;
@@ -42,37 +43,45 @@ export interface ListWorkspaceABTests0Request {
 export interface PauseWorkspaceABTest0Request {
     workspaceId: string;
     testId: string;
+    idempotencyKey?: string;
 }
 export interface SetWorkspaceABTestDuration0Request {
     workspaceId: string;
     testId: string;
     setWorkspaceABTestDurationRequest: SetWorkspaceABTestDurationRequest;
+    idempotencyKey?: string;
 }
 export interface StartWorkspaceABTest0Request {
     workspaceId: string;
     testId: string;
+    idempotencyKey?: string;
 }
 export interface StopWorkspaceABTest0Request {
     workspaceId: string;
     testId: string;
+    idempotencyKey?: string;
     stopWorkspaceABTestRequest?: StopWorkspaceABTestRequest;
 }
 export interface UpdateWorkspaceABTest0Request {
     workspaceId: string;
     testId: string;
     updateABTestRequest: UpdateABTestRequest;
+    idempotencyKey?: string;
 }
 export interface ValidateWorkspaceCompositionDeletion0Request {
     workspaceId: string;
     validateWorkspaceCompositionDeletionRequest: ValidateWorkspaceCompositionDeletionRequest;
+    idempotencyKey?: string;
 }
 export interface ValidateWorkspaceGoalTracking0Request {
     workspaceId: string;
     validateWorkspaceGoalTrackingRequest: ValidateWorkspaceGoalTrackingRequest;
+    idempotencyKey?: string;
 }
 export interface ValidateWorkspaceWidgetDeletion0Request {
     workspaceId: string;
     validateWorkspaceWidgetDeletionRequest: ValidateWorkspaceWidgetDeletionRequest;
+    idempotencyKey?: string;
 }
 /**
  *