@zitadel/api 0.0.0

package/src/generated/endpoints/zitadelNextGen.ts

@@ -0,0 +1,1213 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import { getProxyPath } from "../../runtime/base-url";
+import { customFetch } from "../../runtime/fetch";
+import type {
+  AuthorizeDevice200,
+  AuthorizeDeviceParams,
+  AuthorizeGetDefault,
+  AuthorizeGetParams,
+  CreateAuthAttempt201,
+  CreateAuthAttemptBody,
+  CreateFlow201,
+  CreateFlowBody,
+  CreateFlowDefinition201,
+  CreateFlowDefinitionBody,
+  CreateHandoff200,
+  CreateProject201,
+  CreateProjectBody,
+  CreateSchema201,
+  CreateSchemaBody,
+  CreateSchemaParams,
+  CreateSession201,
+  CreateSessionBody,
+  CreateTeam201,
+  CreateTeamBody,
+  CreateTeamParams,
+  CreateUser201,
+  CreateUserBody,
+  CreateUserParams,
+  EndSessionParams,
+  ExchangeHandoff200,
+  ExchangeHandoffBody,
+  ExchangeHandoffParams,
+  GetAuthAttempt200,
+  GetFlowDefinition200,
+  GetFlowStep200,
+  GetHealthDefault,
+  GetKeys200,
+  GetLiveDefault,
+  GetMySession200,
+  GetOpenIDConfiguration200,
+  GetProject200,
+  GetReadyDefault,
+  GetSchemaById200,
+  GetSchemaByIdParams,
+  GetSession200,
+  GetSessionParams,
+  GetTeam200,
+  GetTeamParams,
+  GetToken200,
+  GetTokenBody,
+  GetUserByID200,
+  GetUserByIDParams,
+  GetUserInfo200,
+  Introspect200,
+  IntrospectBody,
+  IssueChallenge201,
+  IssueChallengeBody,
+  ListFlowDefinitions200,
+  ListFlowDefinitionsParams,
+  ListSessions200,
+  ListSessionsParams,
+  ListUsers200Item,
+  ListUsersParams,
+  RevokeSessionParams,
+  RevokeTokenBody,
+  SubmitFlowEventBody,
+  SubmitFlowStep200,
+  SubmitFlowStepBody,
+  UpdateFlowDefinition200,
+  UpdateFlowDefinitionBody,
+  VerifyChallengeProof200,
+  VerifyChallengeProofBody,
+} from "../model";
+
+export const getGetOpenIDConfigurationUrl = () => {
+  return `${getProxyPath()}/.well-known/openid-configuration`;
+};
+
+/**
+ * Retrieve the OpenID Connect configuration
+ * @summary Get OpenID Connect configuration
+ */
+export const getOpenIDConfiguration = async (
+  options?: RequestInit,
+): Promise<GetOpenIDConfiguration200> => {
+  return customFetch<GetOpenIDConfiguration200>(getGetOpenIDConfigurationUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getAuthorizeGetUrl = (params: AuthorizeGetParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/auth/authorize?${stringifiedParams}`
+    : `${getProxyPath()}/auth/authorize`;
+};
+
+/**
+ * @summary Authorize a user
+ */
+export const authorizeGet = async (
+  params: AuthorizeGetParams,
+  options?: RequestInit,
+): Promise<AuthorizeGetDefault> => {
+  return customFetch<AuthorizeGetDefault>(getAuthorizeGetUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getAuthorizeDeviceUrl = (params: AuthorizeDeviceParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}`
+    : `${getProxyPath()}/auth/device-authorization`;
+};
+
+/**
+ * @summary Authorize a device
+ */
+export const authorizeDevice = async (
+  params: AuthorizeDeviceParams,
+  options?: RequestInit,
+): Promise<AuthorizeDevice200> => {
+  return customFetch<AuthorizeDevice200>(getAuthorizeDeviceUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getEndSessionUrl = (params?: EndSessionParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/auth/end-session?${stringifiedParams}`
+    : `${getProxyPath()}/auth/end-session`;
+};
+
+/**
+ * @summary End a session
+ */
+export const endSession = async (
+  params?: EndSessionParams,
+  options?: RequestInit,
+): Promise<void> => {
+  return customFetch<void>(getEndSessionUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getIntrospectUrl = () => {
+  return `${getProxyPath()}/auth/introspect`;
+};
+
+/**
+ * @summary Introspect a token
+ */
+export const introspect = async (
+  introspectBody: IntrospectBody,
+  options?: RequestInit,
+): Promise<Introspect200> => {
+  const formUrlEncoded = new URLSearchParams();
+  formUrlEncoded.append(`token`, introspectBody.token);
+  if (introspectBody.token_type_hint !== undefined) {
+    formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
+  }
+
+  return customFetch<Introspect200>(getIntrospectUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
+    body: formUrlEncoded,
+  });
+};
+
+export const getGetKeysUrl = () => {
+  return `${getProxyPath()}/auth/keys`;
+};
+
+/**
+ * @summary Get public keys
+ */
+export const getKeys = async (options?: RequestInit): Promise<GetKeys200> => {
+  return customFetch<GetKeys200>(getGetKeysUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getRevokeTokenUrl = () => {
+  return `${getProxyPath()}/auth/revoke`;
+};
+
+/**
+ * @summary Revoke an access token or refresh token
+ */
+export const revokeToken = async (
+  revokeTokenBody: RevokeTokenBody,
+  options?: RequestInit,
+): Promise<void> => {
+  const formUrlEncoded = new URLSearchParams();
+  if (revokeTokenBody.token !== undefined) {
+    formUrlEncoded.append(`token`, revokeTokenBody.token);
+  }
+  if (revokeTokenBody.token_type_hint !== undefined) {
+    formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
+  }
+
+  return customFetch<void>(getRevokeTokenUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
+    body: formUrlEncoded,
+  });
+};
+
+export const getGetTokenUrl = () => {
+  return `${getProxyPath()}/auth/token`;
+};
+
+/**
+ * @summary Get accesstoken
+ */
+export const getToken = async (
+  getTokenBody: GetTokenBody,
+  options?: RequestInit,
+): Promise<GetToken200> => {
+  const formUrlEncoded = new URLSearchParams();
+  if (getTokenBody.code !== undefined) {
+    formUrlEncoded.append(`code`, getTokenBody.code);
+  }
+  if (getTokenBody.client_assertion !== undefined) {
+    formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
+  }
+  if (getTokenBody.client_assertion_type !== undefined) {
+    formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
+  }
+  if (getTokenBody.client_id !== undefined) {
+    formUrlEncoded.append(`client_id`, getTokenBody.client_id);
+  }
+  if (getTokenBody.client_secret !== undefined) {
+    formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
+  }
+  if (getTokenBody.code_verifier !== undefined) {
+    formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
+  }
+  if (getTokenBody.grant_type !== undefined) {
+    formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
+  }
+  if (getTokenBody.redirect_uri !== undefined) {
+    formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
+  }
+
+  return customFetch<GetToken200>(getGetTokenUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
+    body: formUrlEncoded,
+  });
+};
+
+export const getGetUserInfoUrl = () => {
+  return `${getProxyPath()}/auth/userinfo`;
+};
+
+/**
+ * @summary Get user info
+ */
+export const getUserInfo = async (options?: RequestInit): Promise<GetUserInfo200> => {
+  return customFetch<GetUserInfo200>(getGetUserInfoUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetHealthUrl = () => {
+  return `${getProxyPath()}/healthz`;
+};
+
+/**
+ * Check whether the server is healthy
+ * @summary Check server health
+ */
+export const getHealth = async (options?: RequestInit): Promise<GetHealthDefault> => {
+  return customFetch<GetHealthDefault>(getGetHealthUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetLiveUrl = () => {
+  return `${getProxyPath()}/livez`;
+};
+
+/**
+ * Check whether the server is started
+ * @summary Check server liveness
+ */
+export const getLive = async (options?: RequestInit): Promise<GetLiveDefault> => {
+  return customFetch<GetLiveDefault>(getGetLiveUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetReadyUrl = () => {
+  return `${getProxyPath()}/readyz`;
+};
+
+/**
+ * Check whether the server is ready to accept requests
+ * @summary Check server readiness
+ */
+export const getReady = async (options?: RequestInit): Promise<GetReadyDefault> => {
+  return customFetch<GetReadyDefault>(getGetReadyUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateUserUrl = (params: CreateUserParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/user?${stringifiedParams}`
+    : `${getProxyPath()}/user`;
+};
+
+/**
+ * @summary Create user
+ */
+export const createUser = async (
+  createUserBody: CreateUserBody,
+  params: CreateUserParams,
+  options?: RequestInit,
+): Promise<CreateUser201> => {
+  return customFetch<CreateUser201>(getCreateUserUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createUserBody),
+  });
+};
+
+export const getListUsersUrl = (params?: ListUsersParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/user?${stringifiedParams}`
+    : `${getProxyPath()}/user`;
+};
+
+/**
+ * @summary List users
+ */
+export const listUsers = async (
+  params?: ListUsersParams,
+  options?: RequestInit,
+): Promise<ListUsers200Item[]> => {
+  return customFetch<ListUsers200Item[]>(getListUsersUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetUserByIDUrl = (userId: string, params: GetUserByIDParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/user/${userId}?${stringifiedParams}`
+    : `${getProxyPath()}/user/${userId}`;
+};
+
+/**
+ * @summary Get user by ID
+ */
+export const getUserByID = async (
+  userId: string,
+  params: GetUserByIDParams,
+  options?: RequestInit,
+): Promise<GetUserByID200> => {
+  return customFetch<GetUserByID200>(getGetUserByIDUrl(userId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateFlowUrl = () => {
+  return `${getProxyPath()}/flow`;
+};
+
+/**
+ * Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
+
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+ * @summary Start a new flow
+ */
+export const createFlow = async (
+  createFlowBody: CreateFlowBody,
+  options?: RequestInit,
+): Promise<CreateFlow201> => {
+  return customFetch<CreateFlow201>(getCreateFlowUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createFlowBody),
+  });
+};
+
+export const getGetFlowStepUrl = (id: string) => {
+  return `${getProxyPath()}/flow/${id}`;
+};
+
+/**
+ * Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
+
+ * @summary Get current step (re-render)
+ */
+export const getFlowStep = async (id: string, options?: RequestInit): Promise<GetFlowStep200> => {
+  return customFetch<GetFlowStep200>(getGetFlowStepUrl(id), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getSubmitFlowStepUrl = (id: string) => {
+  return `${getProxyPath()}/flow/${id}/submit`;
+};
+
+/**
+ * Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+ * @summary Submit step data and advance
+ */
+export const submitFlowStep = async (
+  id: string,
+  submitFlowStepBody: SubmitFlowStepBody,
+  options?: RequestInit,
+): Promise<SubmitFlowStep200> => {
+  return customFetch<SubmitFlowStep200>(getSubmitFlowStepUrl(id), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(submitFlowStepBody),
+  });
+};
+
+export const getSubmitFlowEventUrl = (id: string) => {
+  return `${getProxyPath()}/flow/${id}/event`;
+};
+
+/**
+ * Submits telemetry or fingerprint data from the frontend.
+Does not advance the state machine. Used for risk evaluation.
+
+ * @summary Submit client-side event
+ */
+export const submitFlowEvent = async (
+  id: string,
+  submitFlowEventBody: SubmitFlowEventBody,
+  options?: RequestInit,
+): Promise<void> => {
+  return customFetch<void>(getSubmitFlowEventUrl(id), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(submitFlowEventBody),
+  });
+};
+
+export const getCreateAuthAttemptUrl = () => {
+  return `${getProxyPath()}/auth_attempts`;
+};
+
+/**
+ * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
+
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+ * @summary Create a new authentication attempt
+ */
+export const createAuthAttempt = async (
+  createAuthAttemptBody: CreateAuthAttemptBody,
+  options?: RequestInit,
+): Promise<CreateAuthAttempt201> => {
+  return customFetch<CreateAuthAttempt201>(getCreateAuthAttemptUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createAuthAttemptBody),
+  });
+};
+
+export const getGetAuthAttemptUrl = (attemptId: string) => {
+  return `${getProxyPath()}/auth_attempts/${attemptId}`;
+};
+
+/**
+ * Polls the current state of an authentication attempt.
+
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+ * @summary Get authentication attempt state
+ */
+export const getAuthAttempt = async (
+  attemptId: string,
+  options?: RequestInit,
+): Promise<GetAuthAttempt200> => {
+  return customFetch<GetAuthAttempt200>(getGetAuthAttemptUrl(attemptId), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getIssueChallengeUrl = (attemptId: string) => {
+  return `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;
+};
+
+/**
+ * Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ * @summary Issue a factor challenge
+ */
+export const issueChallenge = async (
+  attemptId: string,
+  issueChallengeBody: IssueChallengeBody,
+  options?: RequestInit,
+): Promise<IssueChallenge201> => {
+  return customFetch<IssueChallenge201>(getIssueChallengeUrl(attemptId), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(issueChallengeBody),
+  });
+};
+
+export const getVerifyChallengeProofUrl = (attemptId: string, challengeId: string) => {
+  return `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;
+};
+
+/**
+ * Submits a proof (credential, code, assertion) to verify a factor challenge.
+
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+ * @summary Verify a factor proof
+ */
+export const verifyChallengeProof = async (
+  attemptId: string,
+  challengeId: string,
+  verifyChallengeProofBody: VerifyChallengeProofBody,
+  options?: RequestInit,
+): Promise<VerifyChallengeProof200> => {
+  return customFetch<VerifyChallengeProof200>(getVerifyChallengeProofUrl(attemptId, challengeId), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(verifyChallengeProofBody),
+  });
+};
+
+export const getCreateHandoffUrl = (attemptId: string) => {
+  return `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;
+};
+
+/**
+ * Completes the authentication attempt and mints a `handoff_token`.
+
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
+
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
+
+ * @summary Complete authentication and create handoff token
+ */
+export const createHandoff = async (
+  attemptId: string,
+  options?: RequestInit,
+): Promise<CreateHandoff200> => {
+  return customFetch<CreateHandoff200>(getCreateHandoffUrl(attemptId), {
+    ...options,
+    method: "POST",
+  });
+};
+
+export const getCreateProjectUrl = () => {
+  return `${getProxyPath()}/projects`;
+};
+
+/**
+ * @summary Create project
+ */
+export const createProject = async (
+  createProjectBody: CreateProjectBody,
+  options?: RequestInit,
+): Promise<CreateProject201> => {
+  return customFetch<CreateProject201>(getCreateProjectUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createProjectBody),
+  });
+};
+
+export const getGetProjectUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}`;
+};
+
+/**
+ * Returns the current state of a project.
+
+ * @summary Get project
+ */
+export const getProject = async (
+  projectId: string,
+  options?: RequestInit,
+): Promise<GetProject200> => {
+  return customFetch<GetProject200>(getGetProjectUrl(projectId), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateSessionUrl = () => {
+  return `${getProxyPath()}/sessions`;
+};
+
+/**
+ * Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+  can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+The returned `session_token` authorises GET and DELETE on this session.
+It is superseded when a handoff exchange completes — clients must replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+ * @summary Create an anonymous session shell
+ */
+export const createSession = async (
+  createSessionBody: CreateSessionBody,
+  options?: RequestInit,
+): Promise<CreateSession201> => {
+  return customFetch<CreateSession201>(getCreateSessionUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createSessionBody),
+  });
+};
+
+export const getListSessionsUrl = (params: ListSessionsParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/sessions?${stringifiedParams}`
+    : `${getProxyPath()}/sessions`;
+};
+
+/**
+ * Returns a paginated list of sessions for a project.
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary List sessions
+ */
+export const listSessions = async (
+  params: ListSessionsParams,
+  options?: RequestInit,
+): Promise<ListSessions200> => {
+  return customFetch<ListSessions200>(getListSessionsUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getExchangeHandoffUrl = (params: ExchangeHandoffParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}`
+    : `${getProxyPath()}/sessions/exchange`;
+};
+
+/**
+ * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary Exchange handoff token for a session
+ */
+export const exchangeHandoff = async (
+  exchangeHandoffBody: ExchangeHandoffBody,
+  params: ExchangeHandoffParams,
+  options?: RequestInit,
+): Promise<ExchangeHandoff200> => {
+  return customFetch<ExchangeHandoff200>(getExchangeHandoffUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(exchangeHandoffBody),
+  });
+};
+
+export const getGetSessionUrl = (sessionId: string, params: GetSessionParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
+    : `${getProxyPath()}/sessions/${sessionId}`;
+};
+
+/**
+ * Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get session state
+ */
+export const getSession = async (
+  sessionId: string,
+  params: GetSessionParams,
+  options?: RequestInit,
+): Promise<GetSession200> => {
+  return customFetch<GetSession200>(getGetSessionUrl(sessionId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getRevokeSessionUrl = (sessionId: string, params: RevokeSessionParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
+    : `${getProxyPath()}/sessions/${sessionId}`;
+};
+
+/**
+ * Revokes the session immediately (`state: revoked`). This is the logout operation.
+
+The session_token issued at creation (or superseded by a handoff exchange) is required.
+After revocation, any tokens derived from this session are invalidated.
+
+ * @summary Revoke session
+ */
+export const revokeSession = async (
+  sessionId: string,
+  params: RevokeSessionParams,
+  options?: RequestInit,
+): Promise<void> => {
+  return customFetch<void>(getRevokeSessionUrl(sessionId, params), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getGetMySessionUrl = () => {
+  return `${getProxyPath()}/sessions/me`;
+};
+
+/**
+ * Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get my session state
+ */
+export const getMySession = async (options?: RequestInit): Promise<GetMySession200> => {
+  return customFetch<GetMySession200>(getGetMySessionUrl(), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getRevokeMySessionUrl = () => {
+  return `${getProxyPath()}/sessions/me`;
+};
+
+/**
+ * Revokes the session immediately (`state: revoked`). This is the logout operation.
+
+The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
+After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+
+ * @summary Revoke my session
+ */
+export const revokeMySession = async (options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getRevokeMySessionUrl(), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getCreateSchemaUrl = (params: CreateSchemaParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/schemas?${stringifiedParams}`
+    : `${getProxyPath()}/schemas`;
+};
+
+/**
+ * Create a new schema. The schema definition must include a unique $id field,
+which will be used to identify the schema in future requests. The $id must
+be a valid URI and should ideally point to the location where the schema
+can be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+ * @summary Create new schema
+ */
+export const createSchema = async (
+  createSchemaBody: CreateSchemaBody,
+  params: CreateSchemaParams,
+  options?: RequestInit,
+): Promise<CreateSchema201> => {
+  return customFetch<CreateSchema201>(getCreateSchemaUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createSchemaBody),
+  });
+};
+
+export const getGetSchemaByIdUrl = (id: string, params: GetSchemaByIdParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}`
+    : `${getProxyPath()}/schemas/${id}`;
+};
+
+/**
+ * Get a schema by its ID. This will return the default revision of the schema.
+ * @summary Get schema by ID
+ */
+export const getSchemaById = async (
+  id: string,
+  params: GetSchemaByIdParams,
+  options?: RequestInit,
+): Promise<GetSchemaById200> => {
+  return customFetch<GetSchemaById200>(getGetSchemaByIdUrl(id, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateFlowDefinitionUrl = () => {
+  return `${getProxyPath()}/flow_definitions`;
+};
+
+/**
+ * Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
+
+ * @summary Create a new flow definition
+ */
+export const createFlowDefinition = async (
+  createFlowDefinitionBody: CreateFlowDefinitionBody,
+  options?: RequestInit,
+): Promise<CreateFlowDefinition201> => {
+  return customFetch<CreateFlowDefinition201>(getCreateFlowDefinitionUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createFlowDefinitionBody),
+  });
+};
+
+export const getListFlowDefinitionsUrl = (params: ListFlowDefinitionsParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/flow_definitions?${stringifiedParams}`
+    : `${getProxyPath()}/flow_definitions`;
+};
+
+/**
+ * Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+ * @summary List flow definitions
+ */
+export const listFlowDefinitions = async (
+  params: ListFlowDefinitionsParams,
+  options?: RequestInit,
+): Promise<ListFlowDefinitions200> => {
+  return customFetch<ListFlowDefinitions200>(getListFlowDefinitionsUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+export const getFlowDefinition = async (
+  id: string,
+  options?: RequestInit,
+): Promise<GetFlowDefinition200> => {
+  return customFetch<GetFlowDefinition200>(getGetFlowDefinitionUrl(id), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getUpdateFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Update a flow definition by id
+ * @summary Update a flow definition by id
+ */
+export const updateFlowDefinition = async (
+  id: string,
+  updateFlowDefinitionBody: UpdateFlowDefinitionBody,
+  options?: RequestInit,
+): Promise<UpdateFlowDefinition200> => {
+  return customFetch<UpdateFlowDefinition200>(getUpdateFlowDefinitionUrl(id), {
+    ...options,
+    method: "PATCH",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(updateFlowDefinitionBody),
+  });
+};
+
+export const getDeleteFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Delete a flow definition by id
+ * @summary Delete a flow definition by id
+ */
+export const deleteFlowDefinition = async (id: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteFlowDefinitionUrl(id), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getCreateTeamUrl = (params: CreateTeamParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/teams?${stringifiedParams}`
+    : `${getProxyPath()}/teams`;
+};
+
+/**
+ * @summary Create team
+ */
+export const createTeam = async (
+  params: CreateTeamParams,
+  createTeamBody?: CreateTeamBody,
+  options?: RequestInit,
+): Promise<CreateTeam201> => {
+  return customFetch<CreateTeam201>(getCreateTeamUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createTeamBody),
+  });
+};
+
+export const getGetTeamUrl = (teamId: string, params: GetTeamParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}`
+    : `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Returns the current state of a team.
+
+ * @summary Get team
+ */
+export const getTeam = async (
+  teamId: string,
+  params: GetTeamParams,
+  options?: RequestInit,
+): Promise<GetTeam200> => {
+  return customFetch<GetTeam200>(getGetTeamUrl(teamId, params), {
+    ...options,
+    method: "GET",
+  });
+};