@zernio/node 0.2.506 → 0.2.507

package/dist/index.d.mts

@@ -2107,6 +2107,10 @@ type ApiKey = {
      * 'read-write' allows all operations, 'read' restricts to GET requests only
      */
     permission?: 'read-write' | 'read';
+    /**
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 /**
  * 'full' grants access to all profiles, 'profiles' restricts to specific profiles
@@ -11320,6 +11324,13 @@ type ListApiKeysResponse = ({
 });
 type ListApiKeysError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateApiKeyData = {
     body: {
@@ -11340,6 +11351,10 @@ type CreateApiKeyData = {
          * 'read-write' allows all operations (default), 'read' restricts to GET requests only
          */
         permission?: 'read-write' | 'read';
+        /**
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type CreateApiKeyResponse = ({
@@ -11348,6 +11363,13 @@ type CreateApiKeyResponse = ({
 });
 type CreateApiKeyError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type DeleteApiKeyData = {
     path: {
@@ -11359,13 +11381,27 @@ type DeleteApiKeyResponse = ({
 });
 type DeleteApiKeyError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type ListConnectedAppsResponse = ({
     connectedApps?: Array<ConnectedApp>;
 });
 type ListConnectedAppsError = ({
     error?: string;
-} | ErrorResponse);
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
+});
 type RevokeConnectedAppData = {
     path: {
         /**
@@ -11388,6 +11424,13 @@ type RevokeConnectedAppResponse = ({
 });
 type RevokeConnectedAppError = (ErrorResponse | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateInviteTokenData = {
     body: {
@@ -11419,6 +11462,13 @@ type CreateInviteTokenResponse = ({
 });
 type CreateInviteTokenError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type GetConnectUrlData = {
     path: {
@@ -15507,6 +15557,13 @@ type CreateWebhookSettingsResponse = ({
 });
 type CreateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type UpdateWebhookSettingsData = {
     body: {
@@ -15548,6 +15605,13 @@ type UpdateWebhookSettingsResponse = ({
 });
 type UpdateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type DeleteWebhookSettingsData = {
     query: {
@@ -15618,6 +15682,13 @@ type GetWebhookLogsResponse = ({
 });
 type GetWebhookLogsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type TestWebhookData = {
     body: {

package/dist/index.d.ts

@@ -2107,6 +2107,10 @@ type ApiKey = {
      * 'read-write' allows all operations, 'read' restricts to GET requests only
      */
     permission?: 'read-write' | 'read';
+    /**
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 /**
  * 'full' grants access to all profiles, 'profiles' restricts to specific profiles
@@ -11320,6 +11324,13 @@ type ListApiKeysResponse = ({
 });
 type ListApiKeysError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateApiKeyData = {
     body: {
@@ -11340,6 +11351,10 @@ type CreateApiKeyData = {
          * 'read-write' allows all operations (default), 'read' restricts to GET requests only
          */
         permission?: 'read-write' | 'read';
+        /**
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type CreateApiKeyResponse = ({
@@ -11348,6 +11363,13 @@ type CreateApiKeyResponse = ({
 });
 type CreateApiKeyError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type DeleteApiKeyData = {
     path: {
@@ -11359,13 +11381,27 @@ type DeleteApiKeyResponse = ({
 });
 type DeleteApiKeyError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type ListConnectedAppsResponse = ({
     connectedApps?: Array<ConnectedApp>;
 });
 type ListConnectedAppsError = ({
     error?: string;
-} | ErrorResponse);
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
+});
 type RevokeConnectedAppData = {
     path: {
         /**
@@ -11388,6 +11424,13 @@ type RevokeConnectedAppResponse = ({
 });
 type RevokeConnectedAppError = (ErrorResponse | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateInviteTokenData = {
     body: {
@@ -11419,6 +11462,13 @@ type CreateInviteTokenResponse = ({
 });
 type CreateInviteTokenError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type GetConnectUrlData = {
     path: {
@@ -15507,6 +15557,13 @@ type CreateWebhookSettingsResponse = ({
 });
 type CreateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type UpdateWebhookSettingsData = {
     body: {
@@ -15548,6 +15605,13 @@ type UpdateWebhookSettingsResponse = ({
 });
 type UpdateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type DeleteWebhookSettingsData = {
     query: {
@@ -15618,6 +15682,13 @@ type GetWebhookLogsResponse = ({
 });
 type GetWebhookLogsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type TestWebhookData = {
     body: {

package/dist/index.js

@@ -36,7 +36,7 @@ module.exports = __toCommonJS(index_exports);
 // package.json
 var package_default = {
   name: "@zernio/node",
-  version: "0.2.506",
+  version: "0.2.507",
   description: "The official Node.js library for the Zernio API",
   main: "dist/index.js",
   module: "dist/index.mjs",

package/dist/index.mjs

@@ -5,7 +5,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 // package.json
 var package_default = {
   name: "@zernio/node",
-  version: "0.2.506",
+  version: "0.2.507",
   description: "The official Node.js library for the Zernio API",
   main: "dist/index.js",
   module: "dist/index.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zernio/node",
-  "version": "0.2.506",
+  "version": "0.2.507",
   "description": "The official Node.js library for the Zernio API",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/generated/sdk.gen.ts

@@ -1235,9 +1235,10 @@ export const deleteApiKey = <ThrowOnError extends boolean = false>(options: Opti
  * Returns the OAuth clients (AI assistants and MCP connectors) the authenticated
  * user has authorized and that still hold a live token.
  *
- * Requires a session or a full-scope API key. A profile-scoped API key or an
- * OAuth access token is rejected with 403: an app must not be able to enumerate
- * its sibling authorizations.
+ * Requires a session or a full-access API key. A profile-scoped API key, a
+ * restricted (zrk_) API key, or an OAuth access token is rejected with 403: an
+ * app must not be able to enumerate its sibling authorizations, and connected-app
+ * management is admin-plane.
  *
  */
 export const listConnectedApps = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<unknown, ThrowOnError>) => {
@@ -1256,6 +1257,9 @@ export const listConnectedApps = <ThrowOnError extends boolean = false>(options?
  * Idempotent while the authorization is still on record: revoking an app that
  * was already revoked returns 200 with `revokedTokens: 0`.
  *
+ * Requires a session or a full-access API key. A profile-scoped API key, a
+ * restricted (zrk_) API key, or an OAuth access token is rejected with 403.
+ *
  */
 export const revokeConnectedApp = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<RevokeConnectedAppData, ThrowOnError>) => {
     return (options?.client ?? client).delete<RevokeConnectedAppResponse, RevokeConnectedAppError, ThrowOnError>({
@@ -1269,6 +1273,9 @@ export const revokeConnectedApp = <ThrowOnError extends boolean = false>(options
  * Generate a secure invite link to grant team members access to your profiles.
  * Invites expire after 7 days and are single-use.
  *
+ * Returns 403 when a requested profile is not found or not owned, or when
+ * called with a restricted (zrk_) API key: invite management is admin-plane.
+ *
  */
 export const createInviteToken = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateInviteTokenData, ThrowOnError>) => {
     return (options?.client ?? client).post<CreateInviteTokenResponse, CreateInviteTokenError, ThrowOnError>({
@@ -2809,6 +2816,11 @@ export const getWebhookSettings = <ThrowOnError extends boolean = false>(options
  *
  * Webhooks are automatically disabled after 10 consecutive delivery failures.
  *
+ * A restricted (zrk_) API key can only subscribe to events whose resource group
+ * the key holds; an event outside the key's groups is rejected with 403. Note
+ * that the KEY cannot access private messages; the ACCOUNT's pre-existing
+ * webhook subscriptions are a separate grant surface.
+ *
  */
 export const createWebhookSettings = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateWebhookSettingsData, ThrowOnError>) => {
     return (options?.client ?? client).post<CreateWebhookSettingsResponse, CreateWebhookSettingsError, ThrowOnError>({
@@ -2825,6 +2837,9 @@ export const createWebhookSettings = <ThrowOnError extends boolean = false>(opti
  *
  * Webhooks are automatically disabled after 10 consecutive delivery failures.
  *
+ * A restricted (zrk_) API key can only set `events` to events whose resource
+ * group the key holds; an event outside the key's groups is rejected with 403.
+ *
  */
 export const updateWebhookSettings = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateWebhookSettingsData, ThrowOnError>) => {
     return (options?.client ?? client).put<UpdateWebhookSettingsResponse, UpdateWebhookSettingsError, ThrowOnError>({
@@ -2850,6 +2865,10 @@ export const deleteWebhookSettings = <ThrowOnError extends boolean = false>(opti
  * Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID,
  * plus offset-based pagination.
  *
+ * For a restricted (zrk_) API key, rows for events outside the key's resource
+ * groups are omitted (`pagination.total` may over-count), and an `event` filter
+ * naming such an event is rejected with 403.
+ *
  */
 export const getWebhookLogs = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<GetWebhookLogsData, ThrowOnError>) => {
     return (options?.client ?? client).get<GetWebhookLogsResponse, GetWebhookLogsError, ThrowOnError>({

package/src/generated/types.gen.ts

@@ -920,6 +920,10 @@ export type ApiKey = {
      * 'read-write' allows all operations, 'read' restricts to GET requests only
      */
     permission?: 'read-write' | 'read';
+    /**
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 
 /**
@@ -10614,6 +10618,13 @@ export type ListApiKeysResponse = ({
 
 export type ListApiKeysError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type CreateApiKeyData = {
@@ -10635,6 +10646,10 @@ export type CreateApiKeyData = {
          * 'read-write' allows all operations (default), 'read' restricts to GET requests only
          */
         permission?: 'read-write' | 'read';
+        /**
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 
@@ -10645,6 +10660,13 @@ export type CreateApiKeyResponse = ({
 
 export type CreateApiKeyError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type DeleteApiKeyData = {
@@ -10659,6 +10681,13 @@ export type DeleteApiKeyResponse = ({
 
 export type DeleteApiKeyError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type ListConnectedAppsResponse = ({
@@ -10667,7 +10696,14 @@ export type ListConnectedAppsResponse = ({
 
 export type ListConnectedAppsError = ({
     error?: string;
-} | ErrorResponse);
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
+});
 
 export type RevokeConnectedAppData = {
     path: {
@@ -10693,6 +10729,13 @@ export type RevokeConnectedAppResponse = ({
 
 export type RevokeConnectedAppError = (ErrorResponse | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type CreateInviteTokenData = {
@@ -10727,6 +10770,13 @@ export type CreateInviteTokenResponse = ({
 
 export type CreateInviteTokenError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type GetConnectUrlData = {
@@ -15138,6 +15188,13 @@ export type CreateWebhookSettingsResponse = ({
 
 export type CreateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type UpdateWebhookSettingsData = {
@@ -15182,6 +15239,13 @@ export type UpdateWebhookSettingsResponse = ({
 
 export type UpdateWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type DeleteWebhookSettingsData = {
@@ -15258,6 +15322,13 @@ export type GetWebhookLogsResponse = ({
 
 export type GetWebhookLogsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type TestWebhookData = {