@zernio/node 0.2.507 → 0.2.509

package/dist/index.d.mts

@@ -2108,7 +2108,7 @@ type ApiKey = {
      */
     permission?: 'read-write' | 'read';
     /**
-     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the key cannot read or send private messages through any API surface, and it cannot create or edit a webhook subscription broader than itself: it cannot subscribe to, test-fire, redeliver, or read delivery logs for message events. Subscriptions created earlier, from the dashboard, or with a full-access key keep delivering whatever their own `disabledResourceGroups` allows, so restricting an existing integration end to end means restricting the subscription too. OAuth connector tokens (AI assistants and MCP clients) resolve against the same registry, but their groups are not settable yet: treat an authorized connector as full access.
      */
     disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
@@ -4825,6 +4825,10 @@ type PlatformTarget = {
      * Timestamp when the post was published to this platform
      */
     publishedAt?: string;
+    /**
+     * Set when a post that was successfully published later disappears from the platform (deleted on-platform or taken down by the platform). status stays "published" (it reflects the publish outcome); poll this field to detect post-publish removals. Absent while the post is live, and cleared if the post reappears. Detection runs with the analytics sync, so expect up to a few hours of lag.
+     */
+    removedFromPlatformAt?: (string) | null;
     /**
      * Present and true only when this Instagram reel was launched as a Trial through Zernio (created with platformSpecificData.trialParams). Use it to segment trial reels in analytics. Note: Instagram's Graph API exposes no readable trial field, so this reflects creation-time intent only. It indicates the reel STARTED as a trial, not whether or when it graduated.
      */
@@ -6428,6 +6432,10 @@ type Webhook = {
     customHeaders?: {
         [key: string]: (string);
     };
+    /**
+     * Resource groups this subscription does not receive (opt-out denylist, same vocabulary and same semantics as the field on API keys). Absent or empty means the subscription receives every event listed in `events`, which is how every subscription created before this field existed behaves. An event whose group is listed here is dropped before delivery even when it is still present in `events`, and the same check runs on every replay path (test fire, redelivery, dead-letter requeue). Editing the denylist applies to every event emitted afterwards; events already queued when the edit landed can still be delivered for up to five minutes after they were enqueued.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 /**
  * A single webhook delivery attempt recorded by Zernio (30-day retention).
@@ -11352,7 +11360,7 @@ type CreateApiKeyData = {
          */
         permission?: 'read-write' | 'read';
         /**
-         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own `disabledResourceGroups`, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.
          */
         disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
@@ -15520,6 +15528,13 @@ type GetWebhookSettingsResponse = ({
 });
 type GetWebhookSettingsError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateWebhookSettingsData = {
     body: {
@@ -15549,6 +15564,10 @@ type CreateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in `events`. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type CreateWebhookSettingsResponse = ({
@@ -15597,6 +15616,10 @@ type UpdateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Replaces the subscription's denylist. Send an empty array to clear it and receive every event in `events` again. Omitting the field leaves the current denylist untouched. Applies to events emitted after the update; already-queued events can still deliver for up to five minutes after they were enqueued. When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned back in either way, so a restricted key can neither clear nor widen a subscription past its own groups.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type UpdateWebhookSettingsResponse = ({
@@ -15626,6 +15649,13 @@ type DeleteWebhookSettingsResponse = ({
 });
 type DeleteWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type GetWebhookLogsData = {
     query?: {
@@ -15704,6 +15734,13 @@ type TestWebhookResponse = ({
 });
 type TestWebhookError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 } | {
     success?: boolean;
     message?: string;

package/dist/index.d.ts

@@ -2108,7 +2108,7 @@ type ApiKey = {
      */
     permission?: 'read-write' | 'read';
     /**
-     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the key cannot read or send private messages through any API surface, and it cannot create or edit a webhook subscription broader than itself: it cannot subscribe to, test-fire, redeliver, or read delivery logs for message events. Subscriptions created earlier, from the dashboard, or with a full-access key keep delivering whatever their own `disabledResourceGroups` allows, so restricting an existing integration end to end means restricting the subscription too. OAuth connector tokens (AI assistants and MCP clients) resolve against the same registry, but their groups are not settable yet: treat an authorized connector as full access.
      */
     disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
@@ -4825,6 +4825,10 @@ type PlatformTarget = {
      * Timestamp when the post was published to this platform
      */
     publishedAt?: string;
+    /**
+     * Set when a post that was successfully published later disappears from the platform (deleted on-platform or taken down by the platform). status stays "published" (it reflects the publish outcome); poll this field to detect post-publish removals. Absent while the post is live, and cleared if the post reappears. Detection runs with the analytics sync, so expect up to a few hours of lag.
+     */
+    removedFromPlatformAt?: (string) | null;
     /**
      * Present and true only when this Instagram reel was launched as a Trial through Zernio (created with platformSpecificData.trialParams). Use it to segment trial reels in analytics. Note: Instagram's Graph API exposes no readable trial field, so this reflects creation-time intent only. It indicates the reel STARTED as a trial, not whether or when it graduated.
      */
@@ -6428,6 +6432,10 @@ type Webhook = {
     customHeaders?: {
         [key: string]: (string);
     };
+    /**
+     * Resource groups this subscription does not receive (opt-out denylist, same vocabulary and same semantics as the field on API keys). Absent or empty means the subscription receives every event listed in `events`, which is how every subscription created before this field existed behaves. An event whose group is listed here is dropped before delivery even when it is still present in `events`, and the same check runs on every replay path (test fire, redelivery, dead-letter requeue). Editing the denylist applies to every event emitted afterwards; events already queued when the edit landed can still be delivered for up to five minutes after they were enqueued.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 /**
  * A single webhook delivery attempt recorded by Zernio (30-day retention).
@@ -11352,7 +11360,7 @@ type CreateApiKeyData = {
          */
         permission?: 'read-write' | 'read';
         /**
-         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own `disabledResourceGroups`, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.
          */
         disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
@@ -15520,6 +15528,13 @@ type GetWebhookSettingsResponse = ({
 });
 type GetWebhookSettingsError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type CreateWebhookSettingsData = {
     body: {
@@ -15549,6 +15564,10 @@ type CreateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in `events`. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type CreateWebhookSettingsResponse = ({
@@ -15597,6 +15616,10 @@ type UpdateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Replaces the subscription's denylist. Send an empty array to clear it and receive every event in `events` again. Omitting the field leaves the current denylist untouched. Applies to events emitted after the update; already-queued events can still deliver for up to five minutes after they were enqueued. When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned back in either way, so a restricted key can neither clear nor widen a subscription past its own groups.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 type UpdateWebhookSettingsResponse = ({
@@ -15626,6 +15649,13 @@ type DeleteWebhookSettingsResponse = ({
 });
 type DeleteWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 type GetWebhookLogsData = {
     query?: {
@@ -15704,6 +15734,13 @@ type TestWebhookResponse = ({
 });
 type TestWebhookError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 } | {
     success?: boolean;
     message?: string;

package/dist/index.js

@@ -36,7 +36,7 @@ module.exports = __toCommonJS(index_exports);
 // package.json
 var package_default = {
   name: "@zernio/node",
-  version: "0.2.507",
+  version: "0.2.509",
   description: "The official Node.js library for the Zernio API",
   main: "dist/index.js",
   module: "dist/index.mjs",

package/dist/index.mjs

@@ -5,7 +5,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 // package.json
 var package_default = {
   name: "@zernio/node",
-  version: "0.2.507",
+  version: "0.2.509",
   description: "The official Node.js library for the Zernio API",
   main: "dist/index.js",
   module: "dist/index.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zernio/node",
-  "version": "0.2.507",
+  "version": "0.2.509",
   "description": "The official Node.js library for the Zernio API",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/generated/sdk.gen.ts

@@ -2817,9 +2817,16 @@ export const getWebhookSettings = <ThrowOnError extends boolean = false>(options
  * Webhooks are automatically disabled after 10 consecutive delivery failures.
  *
  * A restricted (zrk_) API key can only subscribe to events whose resource group
- * the key holds; an event outside the key's groups is rejected with 403. Note
- * that the KEY cannot access private messages; the ACCOUNT's pre-existing
- * webhook subscriptions are a separate grant surface.
+ * the key holds; an event outside the key's groups is rejected with 403, so a
+ * restricted key can never create a subscription broader than itself.
+ *
+ * `disabledResourceGroups` restricts the subscription itself, independently of
+ * which key or session later reads it. Events in a disabled group are dropped
+ * before delivery to this endpoint, on live delivery and on every replay path
+ * (test fire, redelivery, dead-letter requeue), even if they are listed in
+ * `events`. Omit it to receive everything in `events`, which is how existing
+ * subscriptions behave. A restricted key's own disabled groups are always
+ * unioned in.
  *
  */
 export const createWebhookSettings = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<CreateWebhookSettingsData, ThrowOnError>) => {
@@ -2839,6 +2846,21 @@ export const createWebhookSettings = <ThrowOnError extends boolean = false>(opti
  *
  * A restricted (zrk_) API key can only set `events` to events whose resource
  * group the key holds; an event outside the key's groups is rejected with 403.
+ * It also cannot widen an existing subscription past its own groups.
+ *
+ * `disabledResourceGroups` replaces the subscription's own denylist, which
+ * applies to delivery regardless of which key or session created it. Send an
+ * empty array to clear it. A restricted key's own disabled groups are unioned
+ * into the stored value on every update, so repointing a legacy unrestricted
+ * subscription with a restricted key also narrows it.
+ *
+ * Timing: the new denylist applies to every event emitted after the update.
+ * Events already queued for delivery when the update landed were filtered
+ * against the previous denylist and can still arrive at your endpoint for up
+ * to five minutes after they were enqueued, because the delivery worker
+ * trusts a five-minute enqueue-time snapshot before re-checking the
+ * subscription. Retries beyond that window, dead-letter replays, test fires,
+ * and redeliveries are all checked against the current denylist.
  *
  */
 export const updateWebhookSettings = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<UpdateWebhookSettingsData, ThrowOnError>) => {
@@ -2867,7 +2889,10 @@ export const deleteWebhookSettings = <ThrowOnError extends boolean = false>(opti
  *
  * For a restricted (zrk_) API key, rows for events outside the key's resource
  * groups are omitted (`pagination.total` may over-count), and an `event` filter
- * naming such an event is rejected with 403.
+ * naming such an event is rejected with 403. Events blocked by a subscription's
+ * own `disabledResourceGroups` are dropped before delivery, so they produce no
+ * log rows for anyone; the exception is the five-minute tail after a denylist
+ * change, where an already-queued event can still be delivered and logged.
  *
  */
 export const getWebhookLogs = <ThrowOnError extends boolean = false>(options?: OptionsLegacyParser<GetWebhookLogsData, ThrowOnError>) => {
@@ -2881,6 +2906,13 @@ export const getWebhookLogs = <ThrowOnError extends boolean = false>(options?: O
  * Send test webhook
  * Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: "webhook.test" to distinguish it from real events.
  *
+ * `webhook.test` belongs to the `webhooks` resource group, so a key with that
+ * group disabled is rejected with 403, as is a test fire on a subscription that
+ * lists `webhooks` in its own `disabledResourceGroups` (a 403, not a reported
+ * delivery failure). Replays of real events (redelivery, dead-letter requeue) run
+ * the same checks as live delivery, against both the key's groups and the
+ * subscription's.
+ *
  */
 export const testWebhook = <ThrowOnError extends boolean = false>(options: OptionsLegacyParser<TestWebhookData, ThrowOnError>) => {
     return (options?.client ?? client).post<TestWebhookResponse, TestWebhookError, ThrowOnError>({

package/src/generated/types.gen.ts

@@ -921,7 +921,7 @@ export type ApiKey = {
      */
     permission?: 'read-write' | 'read';
     /**
-     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+     * Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the key cannot read or send private messages through any API surface, and it cannot create or edit a webhook subscription broader than itself: it cannot subscribe to, test-fire, redeliver, or read delivery logs for message events. Subscriptions created earlier, from the dashboard, or with a full-access key keep delivering whatever their own `disabledResourceGroups` allows, so restricting an existing integration end to end means restricting the subscription too. OAuth connector tokens (AI assistants and MCP clients) resolve against the same registry, but their groups are not settable yet: treat an authorized connector as full access.
      */
     disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
@@ -3739,6 +3739,10 @@ export type PlatformTarget = {
      * Timestamp when the post was published to this platform
      */
     publishedAt?: string;
+    /**
+     * Set when a post that was successfully published later disappears from the platform (deleted on-platform or taken down by the platform). status stays "published" (it reflects the publish outcome); poll this field to detect post-publish removals. Absent while the post is live, and cleared if the post reappears. Detection runs with the analytics sync, so expect up to a few hours of lag.
+     */
+    removedFromPlatformAt?: (string) | null;
     /**
      * Present and true only when this Instagram reel was launched as a Trial through Zernio (created with platformSpecificData.trialParams). Use it to segment trial reels in analytics. Note: Instagram's Graph API exposes no readable trial field, so this reflects creation-time intent only. It indicates the reel STARTED as a trial, not whether or when it graduated.
      */
@@ -5419,6 +5423,10 @@ export type Webhook = {
     customHeaders?: {
         [key: string]: (string);
     };
+    /**
+     * Resource groups this subscription does not receive (opt-out denylist, same vocabulary and same semantics as the field on API keys). Absent or empty means the subscription receives every event listed in `events`, which is how every subscription created before this field existed behaves. An event whose group is listed here is dropped before delivery even when it is still present in `events`, and the same check runs on every replay path (test fire, redelivery, dead-letter requeue). Editing the denylist applies to every event emitted afterwards; events already queued when the edit landed can still be delivered for up to five minutes after they were enqueued.
+     */
+    disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
 };
 
 /**
@@ -10647,7 +10655,7 @@ export type CreateApiKeyData = {
          */
         permission?: 'read-write' | 'read';
         /**
-         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+         * Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own `disabledResourceGroups`, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.
          */
         disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
@@ -15148,6 +15156,13 @@ export type GetWebhookSettingsResponse = ({
 
 export type GetWebhookSettingsError = ({
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type CreateWebhookSettingsData = {
@@ -15178,6 +15193,10 @@ export type CreateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in `events`. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 
@@ -15229,6 +15248,10 @@ export type UpdateWebhookSettingsData = {
         customHeaders?: {
             [key: string]: (string);
         };
+        /**
+         * Replaces the subscription's denylist. Send an empty array to clear it and receive every event in `events` again. Omitting the field leaves the current denylist untouched. Applies to events emitted after the update; already-queued events can still deliver for up to five minutes after they were enqueued. When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned back in either way, so a restricted key can neither clear nor widen a subscription past its own groups.
+         */
+        disabledResourceGroups?: Array<('publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks')>;
     };
 };
 
@@ -15263,6 +15286,13 @@ export type DeleteWebhookSettingsResponse = ({
 
 export type DeleteWebhookSettingsError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 });
 
 export type GetWebhookLogsData = {
@@ -15347,6 +15377,13 @@ export type TestWebhookResponse = ({
 
 export type TestWebhookError = (unknown | {
     error?: string;
+} | {
+    error?: string;
+    code?: 'insufficient_permissions' | 'unclassified_resource';
+    /**
+     * The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+     */
+    required_group?: 'publishing' | 'engagement' | 'messages' | 'contacts' | 'analytics' | 'ads' | 'telephony' | 'accounts' | 'billing' | 'webhooks';
 } | {
     success?: boolean;
     message?: string;