@zitadel/api 0.0.0

package/src/generated/model/authorizeDevice200.ts

@@ -0,0 +1,30 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type AuthorizeDevice200 = {
+  /** The device code that the client will use to poll for authorization.
+   */
+  device_code?: string;
+  /** The number of seconds until the device code expires.
+   */
+  expires_in?: number;
+  /** The minimum amount of time in seconds that the client should wait
+  between polling requests.
+   */
+  interval?: number;
+  /** The user code that the user will enter to authorize the device.
+   */
+  user_code?: string;
+  /** The URI where the user will enter the user code to authorize the device.
+   */
+  verification_uri?: string;
+  /** The complete URI with the user code included, which the user can visit
+  to authorize the device.
+   */
+  verification_uri_complete?: string;
+};

package/src/generated/model/authorizeDevice400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { AuthorizeDevice400Details } from "./authorizeDevice400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type AuthorizeDevice400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: AuthorizeDevice400Details;
+};

package/src/generated/model/authorizeDevice400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type AuthorizeDevice400Details = { [key: string]: unknown };

package/src/generated/model/authorizeDeviceDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { AuthorizeDeviceDefaultDetails } from "./authorizeDeviceDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type AuthorizeDeviceDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: AuthorizeDeviceDefaultDetails;
+};

package/src/generated/model/authorizeDeviceDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type AuthorizeDeviceDefaultDetails = { [key: string]: unknown };

package/src/generated/model/authorizeDeviceParams.ts

@@ -0,0 +1,25 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type AuthorizeDeviceParams = {
+  /**
+ * The client ID of the application that is requesting authorization.
+This is a required parameter and must match the client ID of a
+registered application.
+
+ */
+  client_id: string;
+  /**
+ * The scope parameter is used to specify the permissions that the client
+is requesting. This is a space delimited list of scopes. For example,
+you could use this to request access to the user's profile information or
+to request permission to access certain APIs on behalf of the user.
+
+ */
+  scope?: string;
+};

package/src/generated/model/authorizeGet400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { AuthorizeGet400Details } from "./authorizeGet400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type AuthorizeGet400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: AuthorizeGet400Details;
+};

package/src/generated/model/authorizeGet400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type AuthorizeGet400Details = { [key: string]: unknown };

package/src/generated/model/authorizeGetDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { AuthorizeGetDefaultDetails } from "./authorizeGetDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type AuthorizeGetDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: AuthorizeGetDefaultDetails;
+};

package/src/generated/model/authorizeGetDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type AuthorizeGetDefaultDetails = { [key: string]: unknown };

package/src/generated/model/authorizeGetParams.ts

@@ -0,0 +1,136 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type AuthorizeGetParams = {
+  /**
+ * A space delimited list of Authentication Class References. This can be
+used to specify certain authentication methods or level of assurance
+that is required for the authentication. For example, you could use
+this to require multi-factor authentication.
+
+ */
+  acr_values?: string;
+  /**
+ * The client ID of the application that is requesting authorization.
+This is a required parameter and must match the client ID of a
+registered application.
+
+ */
+  client_id: string;
+  /**
+ * The code challenge is a cryptographic string used in the PKCE (Proof
+Key for Code Exchange) flow to enhance security.
+
+ */
+  code_challenge?: string;
+  /**
+ * The code challenge method is used in conjunction with the code challenge
+in the PKCE flow. It specifies the method used to generate the code
+challenge. Common values are "S256" for SHA-256 hashing and "plain"
+for no hashing.
+
+ */
+  code_challenge_method?: string;
+  /**
+ * The display parameter is used to specify how the authorization server
+should display the authentication and consent user interface. Common
+values include "page" for a full-page display, "popup" for a popup
+window, and "touch" for a mobile-optimized display.
+
+ */
+  display?: string;
+  /**
+ * The ID token hint is a previously issued ID token that can be used to
+pre-fill the authentication form or to provide information about the
+user to the authorization server. This can be useful for single sign-on
+scenarios or for providing a smoother user experience.
+
+ */
+  id_token_hint?: string;
+  /**
+ * The login hint is a hint to the authorization server about the login
+identifier of the user. This can be used to pre-fill the username or
+email field in the authentication form, making it easier for the user
+to log in.
+
+ */
+  login_hint?: string;
+  /**
+ * The max age parameter specifies the maximum amount of time in seconds
+that has passed since the user last authenticated. If the user has not
+authenticated within this time frame, they will be required to re-authenticate.
+
+ */
+  max_age?: number;
+  /**
+ * The nonce parameter is a random string that is used to associate a client
+session with an ID token and to mitigate replay attacks. The authorization
+server should include this value in the ID token that it issues, and the
+client should verify that the value in the ID token matches the value it
+sent in the authorization request.
+
+ */
+  nonce?: string;
+  /**
+ * The prompt parameter is used to specify whether the authorization server
+should prompt the user for re-authentication and consent. Common values
+include "none" for no prompts, "login" to prompt for re-authentication,
+"consent" to prompt for user consent, and "select_account" to prompt
+the user to select an account if they are logged in with multiple accounts.
+
+ */
+  prompt?: string;
+  /**
+ * The redirect URI is the URI to which the authorization server will redirect
+the user after they have authorized or denied the request. This must match
+one of the redirect URIs registered for the client application.
+
+ */
+  redirect_uri?: string;
+  /**
+ * The response mode parameter specifies how the authorization server should
+return the authorization response. Common values include "query" to return
+parameters in the query string, "fragment" to return parameters in the URL
+fragment, and "form_post" to return parameters in an HTTP POST request.
+
+ */
+  response_mode?: string;
+  /**
+ * The response type parameter specifies the type of response that the client
+is expecting from the authorization server. Common values include "code"
+for the authorization code flow, "token" for the implicit flow, and "id_token"
+for OpenID Connect authentication.
+
+ */
+  response_type: string;
+  /**
+ * The scope parameter is used to specify the permissions that the client is
+requesting from the user. This is a space-delimited list of scope values,
+and the authorization server will use this information to determine what
+access to grant to the client application.
+
+ */
+  scope?: string;
+  /**
+ * The state parameter is a random string that is used to maintain state between
+the authorization request and the callback. It is used to prevent cross-site
+request forgery (CSRF) attacks by ensuring that the response received from the
+authorization server corresponds to the request that was sent.
+
+ */
+  state?: string;
+  /**
+ * The ui_locales parameter is used to specify the preferred languages and scripts
+for the user interface that the authorization server should display. This is a
+space-delimited list of BCP47 language tag values, and it can be used to provide
+a localized user experience for users from different regions and language
+preferences.
+
+ */
+  ui_locales?: string;
+};

package/src/generated/model/createAuthAttempt201.ts

@@ -0,0 +1,70 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateAuthAttempt201ChallengesItem } from "./createAuthAttempt201ChallengesItem";
+import type { CreateAuthAttempt201CompletedFactorsItem } from "./createAuthAttempt201CompletedFactorsItem";
+import type { CreateAuthAttempt201RequiredFactorsItem } from "./createAuthAttempt201RequiredFactorsItem";
+import type { CreateAuthAttempt201State } from "./createAuthAttempt201State";
+
+/**
+ * The current state of an authentication attempt.
+
+An attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a handoff token.
+Clients drive the attempt by:
+1. Issuing challenges: POST /auth_attempts/{attempt_id}/challenges
+2. Verifying proofs: POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify
+3. Completing: POST /auth_attempts/{attempt_id}/handoff
+
+ */
+export type CreateAuthAttempt201 = {
+  /**
+   * Unique identifier for this authentication attempt
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  attempt_id: string;
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** Overall state of the authentication attempt:
+  - `in_progress`: factors are still being collected; continue issuing challenges.
+  - `completed`: all required factors have been verified; the attempt is ready for handoff.
+  - `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+  - `expired`: the 15-minute TTL has been exceeded.
+   */
+  state: CreateAuthAttempt201State;
+  /** The session being authenticated into. Either newly created or passed in on POST.
+  For step-up (re-auth), this is the existing session_id provided on creation.
+   */
+  session_id?: string | null;
+  /** The user ID, if known at this point in the flow.
+  Null until an identifier challenge has been verified.
+   */
+  user_id?: string | null;
+  /** The authentication factor methods that the project policy requires in order
+  to complete this attempt. Computed by the server from the project's auth policy.
+  Clients should use this to determine which challenges still need to be issued.
+   */
+  required_factors?: CreateAuthAttempt201RequiredFactorsItem[];
+  /** The factors that have been successfully verified in this attempt so far.
+  Each item includes method-specific metadata in the payload field.
+
+  The flow engine uses verified_at timestamps to enforce time-based policies, such as
+  requiring password verification within the last 5 minutes for step-up auth to
+  access sensitive operations.
+
+  A factor appears here once its challenge reaches `verified` state.
+   */
+  completed_factors?: CreateAuthAttempt201CompletedFactorsItem[];
+  /** All challenges issued within this attempt, in creation order.
+  Use this to track the state of each factor challenge (pending, verified, failed, expired).
+   */
+  challenges?: CreateAuthAttempt201ChallengesItem[];
+  /** When this attempt expires (15-minute TTL from creation) */
+  expires_at?: string;
+  /** When this attempt was created */
+  created_at: string;
+};

package/src/generated/model/createAuthAttempt201ChallengesItem.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateAuthAttempt201ChallengesItemMethod } from "./createAuthAttempt201ChallengesItemMethod";
+import type { CreateAuthAttempt201ChallengesItemPayload } from "./createAuthAttempt201ChallengesItemPayload";
+import type { CreateAuthAttempt201ChallengesItemState } from "./createAuthAttempt201ChallengesItemState";
+
+/**
+ * A factor challenge issued within an authentication attempt.
+
+A challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).
+The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ */
+export type CreateAuthAttempt201ChallengesItem = {
+  /**
+   * Unique identifier for this challenge
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+  /** An authentication factor method. */
+  method: CreateAuthAttempt201ChallengesItemMethod;
+  /** Current state of this challenge:
+  - `pending`: awaiting proof submission
+  - `failed`: proof rejected (invalid credential, wrong code, etc.)
+  - `expired`: challenge TTL exceeded without verification
+   */
+  state: CreateAuthAttempt201ChallengesItemState;
+  /** When this challenge was issued */
+  created_at: string;
+  /** When this challenge expires */
+  expires_at?: string | null;
+  /** Method-specific challenge data. Structure depends on the `method` field.
+  - `identifier`, `password`: null (no additional data needed)
+  - `passkey`: WebAuthn challenge and credential options
+  - `idp`: Authorization URL and provider information
+   */
+  payload?: CreateAuthAttempt201ChallengesItemPayload;
+};

package/src/generated/model/createAuthAttempt201ChallengesItemMethod.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type CreateAuthAttempt201ChallengesItemMethod =
+  (typeof CreateAuthAttempt201ChallengesItemMethod)[keyof typeof CreateAuthAttempt201ChallengesItemMethod];
+
+export const CreateAuthAttempt201ChallengesItemMethod = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/createAuthAttempt201ChallengesItemPayload.ts

@@ -0,0 +1,36 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Method-specific challenge data. Structure depends on the `method` field.
+- `identifier`, `password`: null (no additional data needed)
+- `passkey`: WebAuthn challenge and credential options
+- `idp`: Authorization URL and provider information
+
+ */
+export type CreateAuthAttempt201ChallengesItemPayload =
+  | { [key: string]: unknown }
+  | {
+      /** Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).
+  See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialrequestoptions
+   */
+      public_key: {
+        /** Base64-encoded WebAuthn challenge */
+        challenge: string;
+        /** List of credential IDs that can be used for this authentication */
+        allowed_credentials?: {
+          /** Base64-encoded credential ID */
+          id: string;
+          type: "public-key";
+        }[];
+        /** User verification requirement for this challenge */
+        user_verification?: "required" | "preferred" | "discouraged";
+        /** Relying Party ID for WebAuthn */
+        rp_id?: string;
+      };
+    };

package/src/generated/model/createAuthAttempt201ChallengesItemState.ts

@@ -0,0 +1,23 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Current state of this challenge:
+- `pending`: awaiting proof submission
+- `failed`: proof rejected (invalid credential, wrong code, etc.)
+- `expired`: challenge TTL exceeded without verification
+
+ */
+export type CreateAuthAttempt201ChallengesItemState =
+  (typeof CreateAuthAttempt201ChallengesItemState)[keyof typeof CreateAuthAttempt201ChallengesItemState];
+
+export const CreateAuthAttempt201ChallengesItemState = {
+  pending: "pending",
+  failed: "failed",
+  expired: "expired",
+} as const;

package/src/generated/model/createAuthAttempt201CompletedFactorsItem.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateAuthAttempt201CompletedFactorsItemMethod } from "./createAuthAttempt201CompletedFactorsItemMethod";
+import type { CreateAuthAttempt201CompletedFactorsItemPayload } from "./createAuthAttempt201CompletedFactorsItemPayload";
+
+/**
+ * A successfully verified authentication factor with verification metadata.
+Method-specific details are included in the `payload` field.
+
+ */
+export type CreateAuthAttempt201CompletedFactorsItem = {
+  /** An authentication factor method. */
+  method: CreateAuthAttempt201CompletedFactorsItemMethod;
+  /** When this factor was successfully verified */
+  verified_at: string;
+  /** Method-specific factor metadata. Structure depends on the `method` field.
+  - `identifier`: includes user_id
+  - `password`: no additional data
+  - `passkey`: includes credential details and verification flags
+   */
+  payload?: CreateAuthAttempt201CompletedFactorsItemPayload;
+};

package/src/generated/model/createAuthAttempt201CompletedFactorsItemMethod.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type CreateAuthAttempt201CompletedFactorsItemMethod =
+  (typeof CreateAuthAttempt201CompletedFactorsItemMethod)[keyof typeof CreateAuthAttempt201CompletedFactorsItemMethod];
+
+export const CreateAuthAttempt201CompletedFactorsItemMethod = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/createAuthAttempt201CompletedFactorsItemPayload.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Method-specific factor metadata. Structure depends on the `method` field.
+- `identifier`: includes user_id
+- `password`: no additional data
+- `passkey`: includes credential details and verification flags
+
+ */
+export type CreateAuthAttempt201CompletedFactorsItemPayload =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      user_id: string;
+    }
+  | { [key: string]: unknown }
+  | {
+      /** The credential ID that was used */
+      credential_id: string;
+      /** Whether user verification was performed (PIN/biometric) */
+      user_verified: boolean;
+      /** Whether the credential is backup eligible (can be synced) */
+      backup_eligible?: boolean;
+      /** Whether the credential is currently backed up */
+      backup_state?: boolean;
+      /** Authenticator attachment modality */
+      authenticator_attachment?: "platform" | "cross-platform";
+    };

package/src/generated/model/createAuthAttempt201RequiredFactorsItem.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type CreateAuthAttempt201RequiredFactorsItem =
+  (typeof CreateAuthAttempt201RequiredFactorsItem)[keyof typeof CreateAuthAttempt201RequiredFactorsItem];
+
+export const CreateAuthAttempt201RequiredFactorsItem = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/createAuthAttempt201State.ts

@@ -0,0 +1,25 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Overall state of the authentication attempt:
+- `in_progress`: factors are still being collected; continue issuing challenges.
+- `completed`: all required factors have been verified; the attempt is ready for handoff.
+- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+- `expired`: the 15-minute TTL has been exceeded.
+
+ */
+export type CreateAuthAttempt201State =
+  (typeof CreateAuthAttempt201State)[keyof typeof CreateAuthAttempt201State];
+
+export const CreateAuthAttempt201State = {
+  in_progress: "in_progress",
+  completed: "completed",
+  failed: "failed",
+  expired: "expired",
+} as const;