@workos/openapi-spec 0.68.0 → 0.70.0

package/dist/types.d.ts

@@ -1042,13 +1042,149 @@ export interface paths {
          */
         get: operations["ConnectionsController_list"];
         put?: never;
+        /**
+         * Create a Connection
+         * @description Creates a new connection for an organization. Provide `saml_options` or `oidc_options` to configure the identity provider. When `external_id` matches an existing connection in the organization, that connection is returned instead of creating a duplicate.
+         */
+        post: operations["ConnectionsController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_idp_signing_certs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List IdP signing certificates
+         * @description Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first.
+         */
+        get: operations["SamlIdpSigningCertificatesController_list"];
+        put?: never;
+        /**
+         * Create an IdP signing certificate
+         * @description Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation — the existing certificates keep working until they are deleted or expire.
+         */
+        post: operations["SamlIdpSigningCertificatesController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_idp_signing_certs/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
         post?: never;
+        /**
+         * Delete an IdP signing certificate
+         * @description Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh.
+         */
+        delete: operations["SamlIdpSigningCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_encryption_certs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List SP encryption certificates
+         * @description Lists the public certificates the Identity Provider can use to encrypt SAML responses sent to WorkOS, including expired ones, oldest first.
+         */
+        get: operations["SamlSpEncryptionCertificatesController_list"];
+        put?: never;
+        /**
+         * Create an SP encryption certificate
+         * @description Generates a new encryption key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pairs, provide `saml_options.sp_encryption_key_pairs` when creating the connection instead. Creating a certificate appends rather than replaces: every active private key is tried when decrypting, which lets a rotation overlap the old and new certificates.
+         */
+        post: operations["SamlSpEncryptionCertificatesController_create"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
+    "/connections/{connectionId}/saml_sp_encryption_certs/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete an SP encryption certificate
+         * @description Removes an encryption key pair from the connection. SAML responses encrypted with its certificate can no longer be decrypted, so remove the certificate from the Identity Provider first when rotating.
+         */
+        delete: operations["SamlSpEncryptionCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_signing_cert": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the SP signing certificate
+         * @description Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with `404` when the connection has no request signing key pair.
+         */
+        get: operations["SamlSpSigningCertificatesController_get"];
+        put?: never;
+        /**
+         * Create an SP signing certificate
+         * @description Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pair, provide `saml_options.sp_signing_key_pair` when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement.
+         */
+        post: operations["SamlSpSigningCertificatesController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_signing_cert/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete the SP signing certificate
+         * @description Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating.
+         */
+        delete: operations["SamlSpSigningCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/connections/{id}": {
         parameters: {
             query?: never;
@@ -1070,7 +1206,11 @@ export interface paths {
         delete: operations["ConnectionsController_delete"];
         options?: never;
         head?: never;
-        patch?: never;
+        /**
+         * Update a Connection
+         * @description Updates an existing connection. Only the provided fields are changed; fields that accept `null` are reset to their default behavior.
+         */
+        patch: operations["ConnectionsController_patch"];
         trace?: never;
     };
     "/data-integrations": {
@@ -3147,7 +3287,7 @@ export interface paths {
         post?: never;
         /**
          * Delete a waitlist entry
-         * @description Removes the entry from the waitlist. An invitation created by approving the entry stays valid, so revoke that invitation to withdraw access.
+         * @description Remove the entry from the waitlist. Its email address can join again unless a user with that email now exists in the environment. Deleting the entry does not revoke an invitation created by approving it — [revoke that invitation](/reference/authkit/invitation/revoke) separately to withdraw access.
          */
         delete: operations["WaitlistEntriesController_delete"];
         options?: never;
@@ -3166,7 +3306,11 @@ export interface paths {
         put?: never;
         /**
          * Approve a waitlist entry
-         * @description Approve a waitlist entry and send the resulting user invitation email. Also reverses a denial: a denied entry can be approved.
+         * @description Approve a waitlist entry, create an invitation for its email address, and send the invitation email. Approving a denied entry reverses the denial. The approval is saved even when the invitation steps fail, so instead of retrying the approval, recover based on the outcome:
+         *
+         *     - `200` — the entry is approved. If invitation creation failed, no invitation exists yet; [send](/reference/authkit/invitation/send) one.
+         *     - `422` with code `invitation_email_not_sent` — the entry is approved and an invitation exists, but its email was not sent; [resend](/reference/authkit/invitation/resend) it.
+         *     - `422` with code `invalid_state` — the entry was already approved.
          */
         post: operations["WaitlistEntriesController_approve"];
         delete?: never;
@@ -3186,7 +3330,7 @@ export interface paths {
         put?: never;
         /**
          * Deny a waitlist entry
-         * @description Deny a pending waitlist entry. A denial can be reversed by approving the entry.
+         * @description Deny a pending waitlist entry. Denying an entry that is not pending fails with the code `invalid_state`. A denial can be reversed by approving the entry.
          */
         post: operations["WaitlistEntriesController_deny"];
         delete?: never;
@@ -3204,7 +3348,7 @@ export interface paths {
         };
         /**
          * List waitlists
-         * @description Get a list of the waitlists in the environment.
+         * @description Get a list of the waitlists in the environment. All waitlists are returned in a single response — this endpoint is not paginated, so the `list_metadata` cursors are always `null`.
          */
         get: operations["WaitlistsController_list"];
         put?: never;
@@ -3250,7 +3394,7 @@ export interface paths {
         put?: never;
         /**
          * Create a waitlist entry
-         * @description Add an email address to the waitlist. Creating an entry is idempotent per email address: a request for an email address already on the waitlist returns the existing entry.
+         * @description Add an email address to the waitlist. Email addresses are normalized and unique per environment: a request for an email address already on the waitlist returns the existing entry unchanged (still with status `201`) and does not send another confirmation email. If a user with the email address already exists in the environment, the request fails with the code `user_already_exists`.
          */
         post: operations["WaitlistsController_createEntry"];
         delete?: never;
@@ -3605,7 +3749,6 @@ export interface components {
             expires_at?: string | null;
         };
         /**
-         * @default desc
          * @example desc
          * @enum {string}
          */
@@ -4298,6 +4441,334 @@ export interface components {
              */
             parent_resource_type_slug: string;
         });
+        CreateConnectionKeyPairDto: {
+            /**
+             * @description The PEM-encoded private key.
+             * @example -----BEGIN PRIVATE KEY-----
+             *     MIIE...
+             *     -----END PRIVATE KEY-----
+             */
+            key: string;
+            /**
+             * @description The PEM-encoded X.509 certificate for the key.
+             * @example -----BEGIN CERTIFICATE-----
+             *     MIIC...
+             *     -----END CERTIFICATE-----
+             */
+            cert: string;
+        };
+        CreateConnectionSamlOptionsDto: {
+            /**
+             * Format: uri
+             * @description The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are imported from the metadata document. Mutually exclusive with the manual IdP fields.
+             * @example https://idp.example.com/metadata.xml
+             */
+            idp_metadata_url?: string;
+            /**
+             * Format: uri
+             * @description A custom Assertion Consumer Service (ACS) URL override. When omitted, the standard WorkOS-generated ACS URL is used.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            acs_url?: string;
+            /**
+             * @description A custom Service Provider Entity ID (audience) override. When omitted, the connection external key is used.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            sp_entity_id?: string;
+            /**
+             * @description The Identity Provider Entity ID.
+             * @example https://idp.example.com/entity
+             */
+            idp_entity_id?: string;
+            /**
+             * Format: uri
+             * @description The Identity Provider SSO URL. Required when configuring the connection with manual IdP fields.
+             * @example https://idp.example.com/sso
+             */
+            idp_sso_url?: string;
+            /**
+             * @description The X.509 certificates used to verify signed SAML responses from the Identity Provider. Required when configuring the connection with manual IdP fields.
+             * @example [
+             *       "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
+             *     ]
+             */
+            idp_signing_certs?: string[];
+            /** @description The customer-owned key pair used to sign SAML requests sent to the Identity Provider. When omitted, WorkOS generates and manages the signing key pair. */
+            sp_signing_key_pair?: components["schemas"]["CreateConnectionKeyPairDto"];
+            /** @description The customer-owned key pairs used to decrypt encrypted SAML responses from the Identity Provider. When omitted, WorkOS generates and manages the encryption key pair. */
+            sp_encryption_key_pairs?: components["schemas"]["CreateConnectionKeyPairDto"][];
+        };
+        CreateConnectionOidcOptionsDto: {
+            /**
+             * Format: uri
+             * @description The OIDC discovery endpoint.
+             * @example https://idp.example.com/.well-known/openid-configuration
+             */
+            discovery_endpoint: string;
+            /**
+             * @description The OIDC client ID.
+             * @example client_123
+             */
+            client_id: string;
+            /**
+             * @description The OIDC client secret. Required for `client_secret_basic` and `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned.
+             * @example secret_xyz
+             */
+            client_secret?: string;
+            /**
+             * Format: uri
+             * @description A custom OAuth callback URL override. When omitted, the standard WorkOS-generated redirect URI is used.
+             * @example https://auth.workos.com/sso/oidc/conn_externalkey/callback
+             */
+            redirect_uri?: string;
+            /**
+             * @description Whether PKCE is enabled for the connection.
+             * @default true
+             * @example true
+             */
+            pkce: boolean;
+            /**
+             * @description The token-endpoint client authentication method.
+             * @default client_secret_basic
+             * @example client_secret_basic
+             * @enum {string}
+             */
+            token_authentication_method: "client_secret_post" | "client_secret_basic" | "private_key_jwt";
+            /** @description A key pair for WorkOS to sign `private_key_jwt` client assertions with. Only accepted when `token_authentication_method` is `private_key_jwt`; when omitted, WorkOS generates one and returns its certificate in `oidc_options.jwt_signing_certs`. */
+            jwt_signing_key_pair?: components["schemas"]["CreateConnectionKeyPairDto"];
+            /**
+             * @description The ID-token signing algorithm.
+             * @example RS256
+             * @enum {string}
+             */
+            id_token_signature_algorithm?: "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+            /**
+             * @description Whether to fetch additional profile attributes from the userinfo endpoint.
+             * @example false
+             */
+            fetch_user_info?: boolean;
+        };
+        CreateConnectionStandardAttributesDto: {
+            /**
+             * @description The IdP attribute or claim the profile's `idp_id` is mapped from. When omitted, the default for the connection type is used.
+             * @example sub
+             */
+            idp_id?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `email` is mapped from. When omitted, the default for the connection type is used.
+             * @example email
+             */
+            email?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `first_name` is mapped from. When omitted, the default for the connection type is used.
+             * @example given_name
+             */
+            first_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `last_name` is mapped from. When omitted, the default for the connection type is used.
+             * @example family_name
+             */
+            last_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `groups` are mapped from. `null` leaves the mapping unset.
+             * @example memberOf
+             */
+            groups?: string | null;
+            /**
+             * @description The IdP attribute or claim the profile's `name` is mapped from. `null` leaves the mapping unset.
+             * @example displayName
+             */
+            name?: string | null;
+        };
+        CreateConnectionAttributeMapsDto: {
+            /** @description How IdP attributes or claims map onto the standard WorkOS profile fields. Provided fields override the defaults for the connection type. */
+            standard_attributes?: components["schemas"]["CreateConnectionStandardAttributesDto"];
+            /**
+             * @description How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard.
+             * @example {
+             *       "company": "company_claim"
+             *     }
+             */
+            custom_attributes?: {
+                [key: string]: string;
+            };
+        };
+        CreateConnectionDto: {
+            /**
+             * @description Unique identifier for the Organization in which the Connection resides.
+             * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+             */
+            organization_id: string;
+            /**
+             * @description A human-readable name for the Connection. This will most commonly be the organization's name.
+             * @example Foo Corp
+             */
+            name?: string;
+            /**
+             * @description The customer-owned identifier for the Connection.
+             * @example acme-legacy-conn-42
+             */
+            external_id?: string;
+            /**
+             * @description The type of the Connection. Only SAML and OIDC connection types may be created. When omitted, the type is inferred from the provided options.
+             * @example OktaSAML
+             */
+            connection_type?: string;
+            /** @description How IdP attributes or claims map onto WorkOS profile fields. Provided fields override the defaults for the connection type. */
+            attribute_maps?: components["schemas"]["CreateConnectionAttributeMapsDto"];
+        } & ({
+            /** @description Protocol configuration for SAML connections. Mutually exclusive with `oidc_options`. */
+            saml_options: components["schemas"]["CreateConnectionSamlOptionsDto"];
+        } | {
+            /** @description Protocol configuration for OIDC connections. Mutually exclusive with `saml_options`. */
+            oidc_options: components["schemas"]["CreateConnectionOidcOptionsDto"];
+        });
+        PatchConnectionSamlOptionsDto: {
+            /**
+             * Format: uri
+             * @description The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are re-imported from the metadata document, replacing the current set. Mutually exclusive with the manual IdP fields. Set to `null` to stop tracking a metadata URL.
+             * @example https://idp.example.com/metadata.xml
+             */
+            idp_metadata_url?: string | null;
+            /**
+             * Format: uri
+             * @description A custom Assertion Consumer Service (ACS) URL override. Set to `null` to revert to the standard WorkOS-generated ACS URL.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            acs_url?: string | null;
+            /**
+             * @description A custom Service Provider Entity ID (audience) override. Set to `null` to revert to the connection external key.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            sp_entity_id?: string | null;
+            /**
+             * @description The Identity Provider Entity ID.
+             * @example https://idp.example.com/entity
+             */
+            idp_entity_id?: string;
+            /**
+             * Format: uri
+             * @description The Identity Provider SSO URL.
+             * @example https://idp.example.com/sso
+             */
+            idp_sso_url?: string;
+        };
+        PatchConnectionOidcOptionsDto: {
+            /**
+             * Format: uri
+             * @description The OIDC discovery endpoint.
+             * @example https://idp.example.com/.well-known/openid-configuration
+             */
+            discovery_endpoint?: string;
+            /**
+             * @description The OIDC client ID.
+             * @example client_123
+             */
+            client_id?: string;
+            /**
+             * @description The OIDC client secret. Required when moving the connection to `client_secret_basic` or `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned.
+             * @example secret_xyz
+             */
+            client_secret?: string;
+            /**
+             * Format: uri
+             * @description A custom OAuth callback URL override. Set to `null` to revert to the standard WorkOS-generated redirect URI.
+             * @example https://auth.workos.com/sso/oidc/conn_externalkey/callback
+             */
+            redirect_uri?: string | null;
+            /**
+             * @description Whether PKCE is enabled for the connection.
+             * @example true
+             */
+            pkce?: boolean;
+            /**
+             * @description The token-endpoint client authentication method. Moving to `private_key_jwt` generates a signing key pair if the connection has none; its certificate is returned in `oidc_options.jwt_signing_certs` and must be registered at the Identity Provider.
+             * @example client_secret_basic
+             * @enum {string}
+             */
+            token_authentication_method?: "client_secret_post" | "client_secret_basic" | "private_key_jwt";
+            /**
+             * @description The ID-token signing algorithm.
+             * @example RS256
+             * @enum {string}
+             */
+            id_token_signature_algorithm?: "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+            /**
+             * @description Whether to fetch additional profile attributes from the userinfo endpoint.
+             * @example false
+             */
+            fetch_user_info?: boolean;
+        };
+        PatchConnectionStandardAttributesDto: {
+            /**
+             * @description The IdP attribute or claim the profile's `idp_id` is mapped from.
+             * @example sub
+             */
+            idp_id?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `email` is mapped from.
+             * @example email
+             */
+            email?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `first_name` is mapped from.
+             * @example given_name
+             */
+            first_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `last_name` is mapped from.
+             * @example family_name
+             */
+            last_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `groups` are mapped from. Set to `null` to unset the mapping.
+             * @example memberOf
+             */
+            groups?: string | null;
+            /**
+             * @description The IdP attribute or claim the profile's `name` is mapped from. Set to `null` to unset the mapping.
+             * @example displayName
+             */
+            name?: string | null;
+        };
+        PatchConnectionAttributeMapsDto: {
+            /** @description How IdP attributes or claims map onto the standard WorkOS profile fields. Only the provided fields are updated. */
+            standard_attributes?: components["schemas"]["PatchConnectionStandardAttributesDto"];
+            /**
+             * @description How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. Only the provided keys are updated; a `null` value unsets that mapping.
+             * @example {
+             *       "company": "company_claim"
+             *     }
+             */
+            custom_attributes?: {
+                [key: string]: string | null;
+            };
+        };
+        PatchConnectionDto: {
+            /**
+             * @description A human-readable name for the Connection.
+             * @example Foo Corp
+             */
+            name?: string;
+            /**
+             * @description The customer-owned identifier for the Connection. Set to `null` to stop tracking one.
+             * @example acme-legacy-conn-42
+             */
+            external_id?: string | null;
+            /**
+             * @description The type of the Connection. Immutable after creation — it may be sent, but only with the Connection current type.
+             * @example OktaSAML
+             */
+            connection_type?: string;
+            /** @description How IdP attributes or claims map onto WorkOS profile fields. Only the provided fields are updated. */
+            attribute_maps?: components["schemas"]["PatchConnectionAttributeMapsDto"];
+        } & (Record<string, never> | {
+            /** @description Protocol configuration for SAML connections. Only the provided fields are updated. Mutually exclusive with `oidc_options`. */
+            saml_options: components["schemas"]["PatchConnectionSamlOptionsDto"];
+        } | {
+            /** @description Protocol configuration for OIDC connections. Only the provided fields are updated. Mutually exclusive with `saml_options`. */
+            oidc_options: components["schemas"]["PatchConnectionOidcOptionsDto"];
+        });
         CreateCorsOriginDto: {
             /**
              * @description The origin URL to allow for CORS requests.
@@ -4527,19 +4998,19 @@ export interface components {
             name: string;
             /**
              * Format: uri
-             * @description The provider's OAuth authorization endpoint. Required for OAuth providers; omit for `api_key` providers.
+             * @description The provider's OAuth authorization endpoint. Required for OAuth providers; omit for `api_key` providers. Must be a static URL: `${config.…}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare.
              * @example https://provider.example.com/oauth/authorize
              */
             authorization_url?: string;
             /**
              * Format: uri
-             * @description The provider's OAuth token endpoint. Required for OAuth providers; omit for `api_key` providers.
+             * @description The provider's OAuth token endpoint. Required for OAuth and `client_credentials` providers; omit for `api_key` providers. Must be a static URL: `${config.…}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare.
              * @example https://provider.example.com/oauth/token
              */
             token_url?: string;
             /**
              * Format: uri
-             * @description The endpoint used to refresh tokens, if different from the token endpoint.
+             * @description The endpoint used to refresh tokens, if different from the token endpoint. Must be a static URL, like the other endpoints.
              * @example https://provider.example.com/oauth/token
              */
             refresh_token_url?: string | null;
@@ -4639,19 +5110,19 @@ export interface components {
             name?: string;
             /**
              * Format: uri
-             * @description The provider's OAuth authorization endpoint.
+             * @description The provider's OAuth authorization endpoint. Must be a static URL: `${config.…}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare.
              * @example https://provider.example.com/oauth/authorize
              */
             authorization_url?: string;
             /**
              * Format: uri
-             * @description The provider's OAuth token endpoint.
+             * @description The provider's OAuth token endpoint. Must be a static URL: `${config.…}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare.
              * @example https://provider.example.com/oauth/token
              */
             token_url?: string;
             /**
              * Format: uri
-             * @description The endpoint used to refresh tokens, if different from the token endpoint.
+             * @description The endpoint used to refresh tokens, if different from the token endpoint. Must be a static URL, like the other endpoints.
              * @example https://provider.example.com/oauth/token
              */
             refresh_token_url?: string | null;
@@ -4825,6 +5296,13 @@ export interface components {
              */
             uri: string;
         };
+        CreateSamlIdpSigningCertificateDto: {
+            /**
+             * @description The PEM-encoded X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+        };
         CreateTeamDto: {
             /**
              * Format: email
@@ -5211,7 +5689,7 @@ export interface components {
              */
             email: string;
             /**
-             * @description Object containing additional key/value pairs collected with the waitlist entry. Values are user-provided — treat them as untrusted input when rendering or exporting.
+             * @description Object containing additional key/value pairs collected with the waitlist entry. Supports up to 50 string pairs, with keys up to 40 characters and values up to 600 characters. Values are user-provided — treat them as untrusted input when rendering or exporting.
              * @example {
              *       "company": "Example Corp"
              *     }
@@ -5239,7 +5717,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events: ("agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         UpdateWebhookEndpointDto: {
             /**
@@ -5260,7 +5738,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events?: ("agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events?: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         WidgetSessionTokenDto: {
             /**
@@ -8202,47 +8680,128 @@ export interface components {
              */
             id: string;
             /** @constant */
-            event: "agent.registration.claim.attempt.created";
+            event: "agent.blueprint.created";
             /** @description The event payload. */
             data: {
                 /**
-                 * @description Distinguishes the agent registration claim attempt object.
+                 * @description Distinguishes the agent blueprint object.
                  * @constant
                  */
-                object: "agent_registration_claim_attempt";
+                object: "agent_blueprint";
                 /**
-                 * @description Unique identifier of the agent registration claim attempt.
-                 * @example agent_reg_claim_attempt_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Unique identifier of the agent blueprint.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
                 id: string;
                 /**
-                 * @description The ID of the agent registration.
-                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Human-readable name of the agent blueprint.
+                 * @example Prospecting Agent
                  */
-                agent_registration_id: string;
+                name: string;
                 /**
-                 * @description The ID of the agent registration claim.
-                 * @example agent_reg_claim_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Human-readable description of the agent blueprint.
+                 * @example Finds and qualifies sales prospects.
                  */
-                agent_registration_claim_id: string;
+                description: string | null;
                 /**
-                 * @description The login hint for the claim attempt.
-                 * @example jane@example.com
+                 * @description Permission slugs forming the ceiling on what sessions minted from this blueprint may do.
+                 * @example [
+                 *       "crm:read",
+                 *       "email:send"
+                 *     ]
                  */
-                login_hint: string;
+                permissions: string[];
+                /** @description Who may mint sessions from this blueprint. */
+                invocable_by: {
+                    /**
+                     * @description Role slugs whose members may mint user-delegated sessions from this blueprint.
+                     * @example [
+                     *       "manager"
+                     *     ]
+                     */
+                    role_slugs: string[];
+                    /**
+                     * @description Organizations in which autonomous sessions may be minted from this blueprint.
+                     * @example [
+                     *       "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
+                     *     ]
+                     */
+                    organization_ids: string[];
+                };
+                /** @description Token and session lifetimes for sessions minted from this blueprint. */
+                session_settings: {
+                    /**
+                     * @description Maximum lifetime of a session in seconds; refreshes never extend a session past this.
+                     * @example 3600
+                     */
+                    max_age_seconds: number;
+                    /**
+                     * @description Lifetime of each minted access token in seconds.
+                     * @example 300
+                     */
+                    access_token_ttl_seconds: number;
+                    /**
+                     * @description Lifetime of each rotated refresh token in seconds.
+                     * @example 3600
+                     */
+                    refresh_token_ttl_seconds: number;
+                };
                 /**
-                 * @description The timestamp when the claim attempt expires.
-                 * @example 2024-01-15T10:35:00.000Z
+                 * @description The timestamp when the agent blueprint was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
-                expires_at: string;
+                created_at: string;
                 /**
-                 * @description The timestamp when the claim attempt was created.
-                 * @example 2024-01-15T10:30:00.000Z
+                 * @description The timestamp when the agent blueprint was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.blueprint.deleted";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent blueprint object.
+                 * @constant
+                 */
+                object: "agent_blueprint";
+                /**
+                 * @description Unique identifier of the agent blueprint.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description Human-readable name of the agent blueprint.
+                 * @example Prospecting Agent
+                 */
+                name: string;
+                /**
+                 * @description The timestamp when the agent blueprint was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 created_at: string;
                 /**
-                 * @description The timestamp when the claim attempt was last updated.
-                 * @example 2024-01-15T10:30:00.000Z
+                 * @description The timestamp when the agent blueprint was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 updated_at: string;
             };
@@ -8265,55 +8824,143 @@ export interface components {
              */
             id: string;
             /** @constant */
-            event: "agent.registration.claim.completed";
+            event: "agent.blueprint.updated";
             /** @description The event payload. */
             data: {
                 /**
-                 * @description Distinguishes the agent registration claim object.
+                 * @description Distinguishes the agent blueprint object.
                  * @constant
                  */
-                object: "agent_registration_claim";
+                object: "agent_blueprint";
                 /**
-                 * @description Unique identifier of the agent registration claim.
-                 * @example agent_reg_claim_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Unique identifier of the agent blueprint.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
                 id: string;
                 /**
-                 * @description The ID of the agent registration.
-                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Human-readable name of the agent blueprint.
+                 * @example Prospecting Agent
                  */
-                agent_registration_id: string;
+                name: string;
                 /**
-                 * @description The ID of the claim attempt that completed the claim.
-                 * @example agent_reg_claim_attempt_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Human-readable description of the agent blueprint.
+                 * @example Finds and qualifies sales prospects.
                  */
-                completed_by_attempt_id: string;
-                /** @description The user who completed the claim. */
-                claimed_by: {
+                description: string | null;
+                /**
+                 * @description Permission slugs forming the ceiling on what sessions minted from this blueprint may do.
+                 * @example [
+                 *       "crm:read",
+                 *       "email:send"
+                 *     ]
+                 */
+                permissions: string[];
+                /** @description Who may mint sessions from this blueprint. */
+                invocable_by: {
                     /**
-                     * @description The ID of the user who completed the claim.
-                     * @example user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                     * @description Role slugs whose members may mint user-delegated sessions from this blueprint.
+                     * @example [
+                     *       "manager"
+                     *     ]
                      */
-                    user_id: string;
+                    role_slugs: string[];
                     /**
-                     * @description The ID of the organization the claiming user belongs to.
-                     * @example null
+                     * @description Organizations in which autonomous sessions may be minted from this blueprint.
+                     * @example [
+                     *       "org_01EHWNCE74X7JSDV0X3SZ3KJNY"
+                     *     ]
                      */
-                    organization_id: string | ("null" | null);
+                    organization_ids: string[];
+                };
+                /** @description Token and session lifetimes for sessions minted from this blueprint. */
+                session_settings: {
+                    /**
+                     * @description Maximum lifetime of a session in seconds; refreshes never extend a session past this.
+                     * @example 3600
+                     */
+                    max_age_seconds: number;
+                    /**
+                     * @description Lifetime of each minted access token in seconds.
+                     * @example 300
+                     */
+                    access_token_ttl_seconds: number;
+                    /**
+                     * @description Lifetime of each rotated refresh token in seconds.
+                     * @example 3600
+                     */
+                    refresh_token_ttl_seconds: number;
                 };
                 /**
-                 * @description The timestamp when the claim was completed.
-                 * @example 2024-01-15T10:32:00.000Z
+                 * @description The timestamp when the agent blueprint was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
-                completed_at: string;
+                created_at: string;
                 /**
-                 * @description The timestamp when the claim was created.
-                 * @example 2024-01-15T10:30:00.000Z
+                 * @description The timestamp when the agent blueprint was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance object.
+                 * @constant
+                 */
+                object: "agent_instance";
+                /**
+                 * @description Unique identifier of the agent instance.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent blueprint this instance was minted from.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_blueprint_id: string;
+                /**
+                 * @description The organization the instance acts within.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description The organization membership the instance acts on behalf of; `null` for an autonomous instance.
+                 * @example om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_membership_id: string | null;
+                /**
+                 * @description Whether the instance acts on behalf of a user (`delegated`) or as itself within an organization (`autonomous`).
+                 * @enum {string}
+                 */
+                type: "delegated" | "autonomous";
+                /**
+                 * @description The timestamp when the agent instance was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 created_at: string;
                 /**
-                 * @description The timestamp when the claim was last updated.
-                 * @example 2024-01-15T10:32:00.000Z
+                 * @description The timestamp when the agent instance was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 updated_at: string;
             };
@@ -8336,70 +8983,119 @@ export interface components {
              */
             id: string;
             /** @constant */
-            event: "agent.registration.created";
+            event: "agent.instance.deleted";
             /** @description The event payload. */
             data: {
                 /**
-                 * @description Distinguishes the agent registration object.
+                 * @description Distinguishes the agent instance object.
                  * @constant
                  */
-                object: "agent_registration";
+                object: "agent_instance";
                 /**
-                 * @description Unique identifier of the agent registration.
-                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Unique identifier of the agent instance.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
                 id: string;
-                /** @description The agent identity for this registration. */
-                agent_identity: {
-                    /**
-                     * @description Distinguishes the agent identity object.
-                     * @constant
-                     */
-                    object: "agent_identity";
-                    /**
-                     * @description Unique identifier of the agent identity.
-                     * @example agent_identity_01EHWNCE74X7JSDV0X3SZ3KJNY
-                     */
-                    id: string;
-                    /**
-                     * @description The ID of the userland user bound to this agent identity.
-                     * @example null
-                     */
-                    userland_user_id: string | ("null" | null);
-                };
                 /**
-                 * @description The ID of the organization the registration belongs to.
+                 * @description The agent blueprint this instance was minted from.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_blueprint_id: string;
+                /**
+                 * @description The organization the instance acts within.
                  * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
                 organization_id: string;
                 /**
-                 * @description The current status of the registration.
-                 * @example unverified
-                 * @enum {string}
+                 * @description The organization membership the instance acts on behalf of; `null` for an autonomous instance.
+                 * @example om_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
-                status: "unverified" | "verified" | "expired" | "revoked";
+                organization_membership_id: string | null;
                 /**
-                 * @description The kind of the registration.
-                 * @example anonymous
+                 * @description Whether the instance acts on behalf of a user (`delegated`) or as itself within an organization (`autonomous`).
                  * @enum {string}
                  */
-                kind: "anonymous" | "service_auth" | "identity_assertion";
+                type: "delegated" | "autonomous";
                 /**
-                 * @description The authentication method of the registration.
-                 * @example anonymous
-                 * @enum {string}
+                 * @description The timestamp when the agent instance was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
-                method: "anonymous" | "service_auth" | "id_jag";
+                created_at: string;
                 /**
-                 * @description The timestamp when the registration was created.
-                 * @example 2024-01-15T10:30:00.000Z
+                 * @description The timestamp when the agent instance was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.session.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance session object.
+                 * @constant
+                 */
+                object: "agent_instance_session";
+                /**
+                 * @description Unique identifier of the agent instance session.
+                 * @example agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent instance the session belongs to.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_instance_id: string;
+                /**
+                 * @description The organization the owning agent instance belongs to.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description Timestamp when the session expires.
+                 * @example 2026-01-15T13:00:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * @description Timestamp when the session was revoked; `null` if it has not been revoked.
+                 * @example null
+                 */
+                revoked_at: string | null;
+                /**
+                 * @description The timestamp when the session was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 created_at: string;
                 /**
-                 * @description The timestamp when the registration was last updated.
-                 * @example 2024-01-15T10:30:00.000Z
+                 * @description The timestamp when the session was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 updated_at: string;
+                /**
+                 * @description The permissions granted to the session at mint time.
+                 * @example [
+                 *       "crm:read"
+                 *     ]
+                 */
+                permission_slugs: string[];
             };
             /**
              * Format: date-time
@@ -8420,61 +9116,342 @@ export interface components {
              */
             id: string;
             /** @constant */
-            event: "agent.registration.credential.issued";
+            event: "agent.instance.session.revoked";
             /** @description The event payload. */
             data: {
                 /**
-                 * @description Distinguishes the agent registration credential object.
+                 * @description Distinguishes the agent instance session object.
                  * @constant
                  */
-                object: "agent_registration_credential";
+                object: "agent_instance_session";
                 /**
-                 * @description Unique identifier of the agent registration credential.
-                 * @example agent_reg_credential_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description Unique identifier of the agent instance session.
+                 * @example agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
                 id: string;
                 /**
-                 * @description The ID of the agent registration.
-                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 * @description The agent instance the session belongs to.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
                  */
-                agent_registration_id: string;
-                /** @description Details of the issued credential. */
-                detail: {
-                    /**
-                     * @description The kind of credential issued.
-                     * @constant
-                     */
-                    kind: "api_key";
-                    /**
-                     * @description The ID of the issued API key.
-                     * @example api_key_01HWDP91J37GZW2FT9GCEX8YWV
-                     */
-                    api_key_id: string;
-                } | {
-                    /**
-                     * @description The kind of credential issued.
-                     * @constant
-                     */
-                    kind: "access_token";
-                    /**
-                     * @description The JWT ID of the issued access token.
-                     * @example jti_01EHWNCE74X7JSDV0X3SZ3KJNY
-                     */
-                    jti: string;
-                    /**
-                     * @description The timestamp when the access token expires.
-                     * @example 2024-01-15T11:30:00.000Z
-                     */
-                    expires_at: string | ("null" | null);
-                };
+                agent_instance_id: string;
                 /**
-                 * @description The timestamp when the credential was issued.
-                 * @example 2024-01-15T10:33:00.000Z
+                 * @description The organization the owning agent instance belongs to.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description Timestamp when the session expires.
+                 * @example 2026-01-15T13:00:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * @description Timestamp when the session was revoked; `null` if it has not been revoked.
+                 * @example null
+                 */
+                revoked_at: string | null;
+                /**
+                 * @description The timestamp when the session was created.
+                 * @example 2026-01-15T12:00:00.000Z
                  */
                 created_at: string;
                 /**
-                 * @description The timestamp when the credential was last updated.
-                 * @example 2024-01-15T10:33:00.000Z
+                 * @description The timestamp when the session was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.registration.claim.attempt.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent registration claim attempt object.
+                 * @constant
+                 */
+                object: "agent_registration_claim_attempt";
+                /**
+                 * @description Unique identifier of the agent registration claim attempt.
+                 * @example agent_reg_claim_attempt_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The ID of the agent registration.
+                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_registration_id: string;
+                /**
+                 * @description The ID of the agent registration claim.
+                 * @example agent_reg_claim_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_registration_claim_id: string;
+                /**
+                 * @description The login hint for the claim attempt.
+                 * @example jane@example.com
+                 */
+                login_hint: string;
+                /**
+                 * @description The timestamp when the claim attempt expires.
+                 * @example 2024-01-15T10:35:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * @description The timestamp when the claim attempt was created.
+                 * @example 2024-01-15T10:30:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the claim attempt was last updated.
+                 * @example 2024-01-15T10:30:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.registration.claim.completed";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent registration claim object.
+                 * @constant
+                 */
+                object: "agent_registration_claim";
+                /**
+                 * @description Unique identifier of the agent registration claim.
+                 * @example agent_reg_claim_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The ID of the agent registration.
+                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_registration_id: string;
+                /**
+                 * @description The ID of the claim attempt that completed the claim.
+                 * @example agent_reg_claim_attempt_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                completed_by_attempt_id: string;
+                /** @description The user who completed the claim. */
+                claimed_by: {
+                    /**
+                     * @description The ID of the user who completed the claim.
+                     * @example user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                     */
+                    user_id: string;
+                    /**
+                     * @description The ID of the organization the claiming user belongs to.
+                     * @example null
+                     */
+                    organization_id: string | ("null" | null);
+                };
+                /**
+                 * @description The timestamp when the claim was completed.
+                 * @example 2024-01-15T10:32:00.000Z
+                 */
+                completed_at: string;
+                /**
+                 * @description The timestamp when the claim was created.
+                 * @example 2024-01-15T10:30:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the claim was last updated.
+                 * @example 2024-01-15T10:32:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.registration.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent registration object.
+                 * @constant
+                 */
+                object: "agent_registration";
+                /**
+                 * @description Unique identifier of the agent registration.
+                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /** @description The agent identity for this registration. */
+                agent_identity: {
+                    /**
+                     * @description Distinguishes the agent identity object.
+                     * @constant
+                     */
+                    object: "agent_identity";
+                    /**
+                     * @description Unique identifier of the agent identity.
+                     * @example agent_identity_01EHWNCE74X7JSDV0X3SZ3KJNY
+                     */
+                    id: string;
+                    /**
+                     * @description The ID of the userland user bound to this agent identity.
+                     * @example null
+                     */
+                    userland_user_id: string | ("null" | null);
+                };
+                /**
+                 * @description The ID of the organization the registration belongs to.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description The current status of the registration.
+                 * @example unverified
+                 * @enum {string}
+                 */
+                status: "unverified" | "verified" | "expired" | "revoked";
+                /**
+                 * @description The kind of the registration.
+                 * @example anonymous
+                 * @enum {string}
+                 */
+                kind: "anonymous" | "service_auth" | "identity_assertion";
+                /**
+                 * @description The authentication method of the registration.
+                 * @example anonymous
+                 * @enum {string}
+                 */
+                method: "anonymous" | "service_auth" | "id_jag";
+                /**
+                 * @description The timestamp when the registration was created.
+                 * @example 2024-01-15T10:30:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the registration was last updated.
+                 * @example 2024-01-15T10:30:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.registration.credential.issued";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent registration credential object.
+                 * @constant
+                 */
+                object: "agent_registration_credential";
+                /**
+                 * @description Unique identifier of the agent registration credential.
+                 * @example agent_reg_credential_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The ID of the agent registration.
+                 * @example agent_reg_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_registration_id: string;
+                /** @description Details of the issued credential. */
+                detail: {
+                    /**
+                     * @description The kind of credential issued.
+                     * @constant
+                     */
+                    kind: "api_key";
+                    /**
+                     * @description The ID of the issued API key.
+                     * @example api_key_01HWDP91J37GZW2FT9GCEX8YWV
+                     */
+                    api_key_id: string;
+                } | {
+                    /**
+                     * @description The kind of credential issued.
+                     * @constant
+                     */
+                    kind: "access_token";
+                    /**
+                     * @description The JWT ID of the issued access token.
+                     * @example jti_01EHWNCE74X7JSDV0X3SZ3KJNY
+                     */
+                    jti: string;
+                    /**
+                     * @description The timestamp when the access token expires.
+                     * @example 2024-01-15T11:30:00.000Z
+                     */
+                    expires_at: string | ("null" | null);
+                };
+                /**
+                 * @description The timestamp when the credential was issued.
+                 * @example 2024-01-15T10:33:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the credential was last updated.
+                 * @example 2024-01-15T10:33:00.000Z
                  */
                 updated_at: string;
             };
@@ -13962,6 +14939,142 @@ export interface components {
              * @constant
              */
             object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "resource_export.completed";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The ID of the resource export.
+                 * @example resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                 */
+                id: string;
+                /**
+                 * @description The type of resource being exported.
+                 * @example users
+                 * @enum {string}
+                 */
+                resource_type: "users" | "organizations" | "events" | "sessions";
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "resource_export.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The ID of the resource export.
+                 * @example resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                 */
+                id: string;
+                /**
+                 * @description The type of resource being exported.
+                 * @example users
+                 * @enum {string}
+                 */
+                resource_type: "users" | "organizations" | "events" | "sessions";
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "resource_export.downloaded";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The ID of the resource export.
+                 * @example resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                 */
+                id: string;
+                /**
+                 * @description The type of resource being exported.
+                 * @example users
+                 * @enum {string}
+                 */
+                resource_type: "users" | "organizations" | "events" | "sessions";
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "resource_export.failed";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The ID of the resource export.
+                 * @example resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                 */
+                id: string;
+                /**
+                 * @description The type of resource being exported.
+                 * @example users
+                 * @enum {string}
+                 */
+                resource_type: "users" | "organizations" | "events" | "sessions";
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
         } | {
             /**
              * @description Unique identifier for the event.
@@ -15775,7 +16888,7 @@ export interface components {
              */
             scopes: string[] | null;
             /**
-             * @description The OAuth redirect URI to register with the provider when configuring the custom application.
+             * @description The OAuth redirect URI to register with the provider when configuring the custom application. Empty for `api_key` and `client_credentials` integrations, which run no authorization redirect.
              * @example https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
              */
             redirect_uri: string;
@@ -15786,7 +16899,7 @@ export interface components {
              *     ]
              */
             auth_methods: ("oauth" | "api_key" | "client_credentials")[];
-            /** @description The integration-level OAuth app credentials. `null` for `api_key` integrations, which hold no OAuth credentials (keys are installed per-tenant). */
+            /** @description The integration-level OAuth app credentials. `null` for `api_key` and `client_credentials` integrations, which hold no integration-level credentials (secrets are installed per-tenant). */
             credentials: {
                 /**
                  * @description The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself).
@@ -16111,7 +17224,7 @@ export interface components {
                  */
                 scopes: string[];
                 /**
-                 * @description If the integration has requested scopes that aren't present on the access token, they're listed here.
+                 * @description If the integration has requested scopes that aren't present on the access token, they're listed here. The scopes granted to a client-credentials token are governed by the connected organization's client application, so the integration's configured scopes are requests or defaults rather than guarantees.
                  * @example []
                  */
                 missing_scopes: string[];
@@ -16553,6 +17666,129 @@ export interface components {
              */
             updated_at: string;
         };
+        SamlIdpSigningCertificate: {
+            /**
+             * @description Distinguishes the SAML Identity Provider signing certificate object.
+             * @constant
+             */
+            object: "saml_idp_signing_certificate";
+            /**
+             * @description Unique identifier for the Identity Provider signing certificate.
+             * @example saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
+        SamlIdpSigningCertificateList: {
+            /**
+             * @example list
+             * @constant
+             */
+            object: "list";
+            /** @description Every Identity Provider signing certificate on the Connection, including expired ones, oldest first. */
+            data: components["schemas"]["SamlIdpSigningCertificate"][];
+        };
+        SamlSpEncryptionCertificate: {
+            /**
+             * @description Distinguishes the SAML Service Provider encryption certificate object.
+             * @constant
+             */
+            object: "saml_sp_encryption_certificate";
+            /**
+             * @description Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed.
+             * @example saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
+        SamlSpEncryptionCertificateList: {
+            /**
+             * @example list
+             * @constant
+             */
+            object: "list";
+            /** @description Every Service Provider encryption certificate on the Connection, including expired ones. */
+            data: components["schemas"]["SamlSpEncryptionCertificate"][];
+        };
+        SamlSpSigningCertificate: {
+            /**
+             * @description Distinguishes the SAML Service Provider signing certificate object.
+             * @constant
+             */
+            object: "saml_sp_signing_certificate";
+            /**
+             * @description Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed.
+             * @example saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
         Team: {
             /**
              * @description Distinguishes the team object.
@@ -18208,7 +19444,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -18289,7 +19525,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -19132,7 +20368,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -19608,7 +20844,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The permission slug to filter by. Only child resources where the organization membership has this permission are returned. */
                 permission_slug: string;
@@ -19714,7 +20950,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -19793,7 +21029,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -19874,7 +21110,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter assignments by the ID of the resource. */
                 resource_id?: string;
@@ -21435,7 +22671,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The permission slug to filter by. Only users with this permission on the resource are returned. */
                 permission_slug: string;
@@ -21541,7 +22777,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter assignments by the slug of the role. */
                 role_slug?: string;
@@ -21609,7 +22845,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -21957,7 +23193,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter resources by organization ID. */
                 organization_id?: string;
@@ -22577,7 +23813,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The permission slug to filter by. Only users with this permission on the resource are returned. */
                 permission_slug: string;
@@ -22679,7 +23915,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter assignments by the slug of the role. */
                 role_slug?: string;
@@ -23522,7 +24758,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter Connect Applications by registration type. Specify multiple as a comma-separated list (e.g. `registration_types=dynamic,authenticated`). Defaults to `authenticated` only when not specified. */
                 registration_types?: ("dynamic" | "authenticated")[];
@@ -23920,7 +25156,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter Connections by their type. */
                 connection_type?: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "CloudflareSAML" | "ClassLinkSAML" | "CleverOIDC" | "CyberArkSAML" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
@@ -23978,20 +25214,1117 @@ export interface operations {
             };
         };
     };
-    ConnectionsController_find: {
+    ConnectionsController_create: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                /** @description Unique identifier for the Connection. */
-                id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateConnectionDto"];
+            };
+        };
         responses: {
-            /** @description OK */
-            200: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connection"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example external_id_already_in_use
+                         * @constant
+                         */
+                        code: "external_id_already_in_use";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_or_options_required
+                         * @constant
+                         */
+                        code: "connection_type_or_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_conflicts_with_options
+                         * @constant
+                         */
+                        code: "connection_type_conflicts_with_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example both_saml_and_oidc_options_provided
+                         * @constant
+                         */
+                        code: "both_saml_and_oidc_options_provided";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example ambiguous_saml_options
+                         * @constant
+                         */
+                        code: "ambiguous_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example incomplete_saml_options
+                         * @constant
+                         */
+                        code: "incomplete_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example saml_options_required
+                         * @constant
+                         */
+                        code: "saml_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example oidc_options_required
+                         * @constant
+                         */
+                        code: "oidc_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_certificate
+                         * @constant
+                         */
+                        code: "invalid_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_required
+                         * @constant
+                         */
+                        code: "client_secret_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_not_accepted
+                         * @constant
+                         */
+                        code: "client_secret_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example discovery_endpoint_must_use_https
+                         * @constant
+                         */
+                        code: "discovery_endpoint_must_use_https";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example token_authentication_method_not_supported
+                         * @constant
+                         */
+                        code: "token_authentication_method_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_deletion_in_progress
+                         * @constant
+                         */
+                        code: "connection_deletion_in_progress";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example idp_metadata_fetch_failed
+                         * @constant
+                         */
+                        code: "idp_metadata_fetch_failed";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_could_not_be_verified
+                         * @constant
+                         */
+                        code: "connection_could_not_be_verified";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_idp_sso_url
+                         * @constant
+                         */
+                        code: "invalid_idp_sso_url";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlIdpSigningCertificateList"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSamlIdpSigningCertificateDto"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlIdpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_certificate
+                         * @constant
+                         */
+                        code: "invalid_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example certificate_expired
+                         * @constant
+                         */
+                        code: "certificate_expired";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Identity Provider signing certificate. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example cannot_delete_last_certificate
+                         * @constant
+                         */
+                        code: "cannot_delete_last_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpEncryptionCertificateList"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpEncryptionCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example too_many_sp_encryption_certs
+                         * @constant
+                         */
+                        code: "too_many_sp_encryption_certs";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example sp_signing_cert_already_exists
+                         * @constant
+                         */
+                        code: "sp_signing_cert_already_exists";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    ConnectionsController_find: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -24089,6 +26422,263 @@ export interface operations {
             };
         };
     };
+    ConnectionsController_patch: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PatchConnectionDto"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connection"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example external_id_already_in_use
+                         * @constant
+                         */
+                        code: "external_id_already_in_use";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_conflicts_with_options
+                         * @constant
+                         */
+                        code: "connection_type_conflicts_with_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example both_saml_and_oidc_options_provided
+                         * @constant
+                         */
+                        code: "both_saml_and_oidc_options_provided";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example ambiguous_saml_options
+                         * @constant
+                         */
+                        code: "ambiguous_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example token_authentication_method_not_supported
+                         * @constant
+                         */
+                        code: "token_authentication_method_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example id_token_signature_algorithm_not_supported
+                         * @constant
+                         */
+                        code: "id_token_signature_algorithm_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_required
+                         * @constant
+                         */
+                        code: "client_secret_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_not_accepted
+                         * @constant
+                         */
+                        code: "client_secret_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example discovery_endpoint_must_use_https
+                         * @constant
+                         */
+                        code: "discovery_endpoint_must_use_https";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_deletion_in_progress
+                         * @constant
+                         */
+                        code: "connection_deletion_in_progress";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_updatable
+                         * @constant
+                         */
+                        code: "connection_type_not_updatable";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example idp_metadata_fetch_failed
+                         * @constant
+                         */
+                        code: "idp_metadata_fetch_failed";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_could_not_be_verified
+                         * @constant
+                         */
+                        code: "connection_could_not_be_verified";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
     DataIntegrationsManagementController_listDataIntegrations: {
         parameters: {
             query?: {
@@ -24098,7 +26688,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -24672,7 +27262,7 @@ export interface operations {
                     /**
                      * @description Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
                      * @example {
-                     *       "mydomain": "acme"
+                     *       "salesforce_host": "acme.my.salesforce.com"
                      *     }
                      */
                     config?: {
@@ -24966,7 +27556,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter Directories by their associated organization. */
                 organization_id?: string;
@@ -25131,7 +27721,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API. */
                 directory?: string;
@@ -25262,7 +27852,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API. */
                 directory?: string;
@@ -25405,7 +27995,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter events by one or more event types (e.g. `dsync.user.created`). */
                 events: string[];
@@ -25485,7 +28075,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -26196,7 +28786,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The domains of an Organization. Any Organization with a matching domain will be returned. */
                 domains?: string[];
@@ -26770,7 +29360,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -27013,7 +29603,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -27060,7 +29650,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Search groups by name or by group ID. */
                 search?: string;
@@ -27420,7 +30010,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -27634,7 +30224,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -30189,7 +32779,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -30361,7 +32951,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The ID of the [organization](/reference/organization) that the recipient will join. */
                 organization_id?: string;
@@ -31279,7 +33869,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The ID of the [organization](/reference/organization) which the user belongs to. */
                 organization_id?: string;
@@ -31969,7 +34559,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -32344,7 +34934,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -32673,7 +35263,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /**
                  * @deprecated
@@ -33900,7 +36490,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -34070,7 +36660,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description The ID of the organization to filter user API keys by. When provided, only API keys created against that organization membership are returned. */
                 organization_id?: string;
@@ -34204,7 +36794,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `desc`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -34251,7 +36841,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -34635,7 +37225,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. */
+                /** @description Order the results by the creation time. Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;
@@ -35035,7 +37625,7 @@ export interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
                 id: string;
             };
             cookie?: never;
@@ -35077,7 +37667,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter waitlist entries by their state. */
                 state?: "pending" | "approved" | "denied";
@@ -35086,7 +37676,7 @@ export interface operations {
             };
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
                 id: string;
             };
             cookie?: never;
@@ -35167,7 +37757,7 @@ export interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. Use `default` when adding the first entry — the default waitlist is created automatically. */
                 id: string;
             };
             cookie?: never;
@@ -35723,7 +38313,7 @@ export interface operations {
                 after?: string;
                 /** @description Upper limit on the number of objects to return, between `1` and `100`. */
                 limit?: number;
-                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). */
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
             };
             header?: never;