@zitadel/api 0.0.0

package/src/generated/model/endSessionDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { EndSessionDefaultDetails } from "./endSessionDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type EndSessionDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: EndSessionDefaultDetails;
+};

package/src/generated/model/endSessionDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type EndSessionDefaultDetails = { [key: string]: unknown };

package/src/generated/model/endSessionParams.ts

@@ -0,0 +1,57 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type EndSessionParams = {
+  /**
+ * The client ID is the identifier for the client application that is making
+the request. This is used by the authorization server to identify the
+client and to determine whether it is authorized to perform the requested
+action.
+
+ */
+  client_id?: string;
+  /**
+ * The ID token hint is a previously issued ID token that can be used to
+pre-fill the authentication form or to provide information about the
+user to the authorization server. This can be useful for single sign-on
+scenarios or for providing a smoother user experience.
+
+ */
+  id_token_hint?: string;
+  /**
+ * The logout hint is a hint to the authorization server about the login
+identifier of the user. This can be used to pre-fill the username or email
+field in the logout form, making it easier for the user to log out.
+
+ */
+  logout_hint?: string;
+  /**
+ * The post logout redirect URI is the URI to which the user will be
+redirected after they have logged out. This must be a registered URI
+for the client application and is used to ensure that the user is
+redirected to a safe location after logging out.
+
+ */
+  post_logout_redirect_uri?: string;
+  /**
+ * The state parameter is an opaque value that is used by the client to
+maintain state between the request and the callback. It is typically used
+to prevent cross-site request forgery (CSRF) attacks by including a unique
+value in the request that the client can verify when it receives the callback.
+
+ */
+  state?: string;
+  /**
+ * The ui_locales parameter is a space-separated list of BCP47 language tags
+that are used to indicate the preferred languages and scripts for the user
+interface. This can be used by the authorization server to display the logout
+page in the user's preferred language.
+
+ */
+  ui_locales?: string;
+};

package/src/generated/model/exchangeHandoff200.ts

@@ -0,0 +1,29 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff200Session } from "./exchangeHandoff200Session";
+
+/**
+ * Response for session creation and handoff exchange.
+Includes the session state and the session_token required to manage it.
+
+ */
+export type ExchangeHandoff200 = {
+  /** The current state of a session.
+
+  A session is the durable post-auth primitive. It accumulates verified authentication
+  factors and exposes `assurance_levels[]` — the set of assurance profiles its current
+  factors satisfy. Sessions are read-only from the client's perspective: factors flow
+  in through `auth_attempts`.
+   */
+  session: ExchangeHandoff200Session;
+  /** Bearer token authorising management of this session (GET and DELETE).
+  For anonymous sessions this token is superseded when a handoff exchange completes —
+  clients must replace their stored token at that point.
+   */
+  session_token: string;
+};

package/src/generated/model/exchangeHandoff200Session.ts

@@ -0,0 +1,63 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff200SessionFactorsItem } from "./exchangeHandoff200SessionFactorsItem";
+import type { ExchangeHandoff200SessionMetadata } from "./exchangeHandoff200SessionMetadata";
+import type { ExchangeHandoff200SessionState } from "./exchangeHandoff200SessionState";
+import type { ExchangeHandoff200SessionUserAgent } from "./exchangeHandoff200SessionUserAgent";
+
+/**
+ * The current state of a session.
+
+A session is the durable post-auth primitive. It accumulates verified authentication
+factors and exposes `assurance_levels[]` — the set of assurance profiles its current
+factors satisfy. Sessions are read-only from the client's perspective: factors flow
+in through `auth_attempts`.
+
+ */
+export type ExchangeHandoff200Session = {
+  /**
+   * Unique identifier for this session.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  session_id: string;
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** Current lifecycle state of the session:
+  - `building`: has a user factor but is still gathering authentication factors
+  - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
+  - `expired`: TTL elapsed
+  - `revoked`: explicitly revoked via DELETE
+   */
+  state: ExchangeHandoff200SessionState;
+  /** The authenticated user. Null for anonymous sessions and until the `user`
+  factor has been verified through an `auth_attempt`.
+   */
+  user_id?: string | null;
+  /** Verified authentication factors accumulated by this session.
+  Each key is a factor type (e.g. `password`, `totp`, `passkey`).
+  Each value is a factor event object with at least `verified_at` and
+  method-specific properties (e.g. `user_verified`, `hardware` for passkeys).
+   */
+  factors: ExchangeHandoff200SessionFactorsItem[];
+  /** All assurance levels whose schemas the current session factors satisfy.
+  This list shrinks as factor freshness windows expire and grows when step-up
+  auth_attempts add or refresh factors.
+  Whether any level is "enough" is determined by the request context, not the session.
+   */
+  assurance_levels?: string[];
+  /** Arbitrary key/value metadata attached to the session. */
+  metadata?: ExchangeHandoff200SessionMetadata;
+  /** User agent information captured at session creation. */
+  user_agent?: ExchangeHandoff200SessionUserAgent;
+  /** When this session was created. */
+  created_at: string;
+  /** When this session expires. Short TTL (10 min) for anonymous sessions;
+  reset to the full configured session TTL once the first authentication factor is written.
+   */
+  expires_at: string;
+};

package/src/generated/model/exchangeHandoff200SessionFactorsItem.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff200SessionFactorsItemMethod } from "./exchangeHandoff200SessionFactorsItemMethod";
+import type { ExchangeHandoff200SessionFactorsItemPayload } from "./exchangeHandoff200SessionFactorsItemPayload";
+
+/**
+ * A successfully verified authentication factor with verification metadata.
+Method-specific details are included in the `payload` field.
+
+ */
+export type ExchangeHandoff200SessionFactorsItem = {
+  /** An authentication factor method. */
+  method: ExchangeHandoff200SessionFactorsItemMethod;
+  /** When this factor was successfully verified */
+  verified_at: string;
+  /** Method-specific factor metadata. Structure depends on the `method` field.
+  - `identifier`: includes user_id
+  - `password`: no additional data
+  - `passkey`: includes credential details and verification flags
+   */
+  payload?: ExchangeHandoff200SessionFactorsItemPayload;
+};

package/src/generated/model/exchangeHandoff200SessionFactorsItemMethod.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type ExchangeHandoff200SessionFactorsItemMethod =
+  (typeof ExchangeHandoff200SessionFactorsItemMethod)[keyof typeof ExchangeHandoff200SessionFactorsItemMethod];
+
+export const ExchangeHandoff200SessionFactorsItemMethod = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/exchangeHandoff200SessionFactorsItemPayload.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Method-specific factor metadata. Structure depends on the `method` field.
+- `identifier`: includes user_id
+- `password`: no additional data
+- `passkey`: includes credential details and verification flags
+
+ */
+export type ExchangeHandoff200SessionFactorsItemPayload =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      user_id: string;
+    }
+  | { [key: string]: unknown }
+  | {
+      /** The credential ID that was used */
+      credential_id: string;
+      /** Whether user verification was performed (PIN/biometric) */
+      user_verified: boolean;
+      /** Whether the credential is backup eligible (can be synced) */
+      backup_eligible?: boolean;
+      /** Whether the credential is currently backed up */
+      backup_state?: boolean;
+      /** Authenticator attachment modality */
+      authenticator_attachment?: "platform" | "cross-platform";
+    };

package/src/generated/model/exchangeHandoff200SessionMetadata.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Arbitrary key/value metadata attached to the session.
+ */
+export type ExchangeHandoff200SessionMetadata = { [key: string]: unknown } | null;

package/src/generated/model/exchangeHandoff200SessionState.ts

@@ -0,0 +1,25 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Current lifecycle state of the session:
+- `building`: has a user factor but is still gathering authentication factors
+- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
+- `expired`: TTL elapsed
+- `revoked`: explicitly revoked via DELETE
+
+ */
+export type ExchangeHandoff200SessionState =
+  (typeof ExchangeHandoff200SessionState)[keyof typeof ExchangeHandoff200SessionState];
+
+export const ExchangeHandoff200SessionState = {
+  building: "building",
+  active: "active",
+  expired: "expired",
+  revoked: "revoked",
+} as const;

package/src/generated/model/exchangeHandoff200SessionUserAgent.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * User agent information captured at session creation.
+ */
+export type ExchangeHandoff200SessionUserAgent = {
+  /** Client-supplied device fingerprint. */
+  fingerprint?: string;
+  /** IP address of the client at session creation. */
+  ip?: string;
+  [key: string]: unknown;
+} | null;

package/src/generated/model/exchangeHandoff400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff400Details } from "./exchangeHandoff400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type ExchangeHandoff400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: ExchangeHandoff400Details;
+};

package/src/generated/model/exchangeHandoff400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type ExchangeHandoff400Details = { [key: string]: unknown };

package/src/generated/model/exchangeHandoff401.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff401Details } from "./exchangeHandoff401Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type ExchangeHandoff401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: ExchangeHandoff401Details;
+};

package/src/generated/model/exchangeHandoff401Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type ExchangeHandoff401Details = { [key: string]: unknown };

package/src/generated/model/exchangeHandoff410.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoff410Details } from "./exchangeHandoff410Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type ExchangeHandoff410 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: ExchangeHandoff410Details;
+};

package/src/generated/model/exchangeHandoff410Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type ExchangeHandoff410Details = { [key: string]: unknown };

package/src/generated/model/exchangeHandoffBody.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Request to exchange a handoff token for a session and session_token.
+ */
+export type ExchangeHandoffBody = {
+  /** The one-time handoff token minted by `POST /auth_attempts/{id}/handoff`.
+  Single-use — replaying it after a successful exchange returns `410 Gone`.
+   */
+  handoff_token: string;
+  /** Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server
+  uses the configured default. Must not exceed the configured maximum.
+   */
+  ttl?: string;
+};

package/src/generated/model/exchangeHandoffDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { ExchangeHandoffDefaultDetails } from "./exchangeHandoffDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type ExchangeHandoffDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: ExchangeHandoffDefaultDetails;
+};

package/src/generated/model/exchangeHandoffDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type ExchangeHandoffDefaultDetails = { [key: string]: unknown };

package/src/generated/model/exchangeHandoffParams.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type ExchangeHandoffParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};

package/src/generated/model/getAuthAttempt200.ts

@@ -0,0 +1,70 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetAuthAttempt200ChallengesItem } from "./getAuthAttempt200ChallengesItem";
+import type { GetAuthAttempt200CompletedFactorsItem } from "./getAuthAttempt200CompletedFactorsItem";
+import type { GetAuthAttempt200RequiredFactorsItem } from "./getAuthAttempt200RequiredFactorsItem";
+import type { GetAuthAttempt200State } from "./getAuthAttempt200State";
+
+/**
+ * The current state of an authentication attempt.
+
+An attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a handoff token.
+Clients drive the attempt by:
+1. Issuing challenges: POST /auth_attempts/{attempt_id}/challenges
+2. Verifying proofs: POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify
+3. Completing: POST /auth_attempts/{attempt_id}/handoff
+
+ */
+export type GetAuthAttempt200 = {
+  /**
+   * Unique identifier for this authentication attempt
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  attempt_id: string;
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** Overall state of the authentication attempt:
+  - `in_progress`: factors are still being collected; continue issuing challenges.
+  - `completed`: all required factors have been verified; the attempt is ready for handoff.
+  - `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+  - `expired`: the 15-minute TTL has been exceeded.
+   */
+  state: GetAuthAttempt200State;
+  /** The session being authenticated into. Either newly created or passed in on POST.
+  For step-up (re-auth), this is the existing session_id provided on creation.
+   */
+  session_id?: string | null;
+  /** The user ID, if known at this point in the flow.
+  Null until an identifier challenge has been verified.
+   */
+  user_id?: string | null;
+  /** The authentication factor methods that the project policy requires in order
+  to complete this attempt. Computed by the server from the project's auth policy.
+  Clients should use this to determine which challenges still need to be issued.
+   */
+  required_factors?: GetAuthAttempt200RequiredFactorsItem[];
+  /** The factors that have been successfully verified in this attempt so far.
+  Each item includes method-specific metadata in the payload field.
+
+  The flow engine uses verified_at timestamps to enforce time-based policies, such as
+  requiring password verification within the last 5 minutes for step-up auth to
+  access sensitive operations.
+
+  A factor appears here once its challenge reaches `verified` state.
+   */
+  completed_factors?: GetAuthAttempt200CompletedFactorsItem[];
+  /** All challenges issued within this attempt, in creation order.
+  Use this to track the state of each factor challenge (pending, verified, failed, expired).
+   */
+  challenges?: GetAuthAttempt200ChallengesItem[];
+  /** When this attempt expires (15-minute TTL from creation) */
+  expires_at?: string;
+  /** When this attempt was created */
+  created_at: string;
+};

package/src/generated/model/getAuthAttempt200ChallengesItem.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetAuthAttempt200ChallengesItemMethod } from "./getAuthAttempt200ChallengesItemMethod";
+import type { GetAuthAttempt200ChallengesItemPayload } from "./getAuthAttempt200ChallengesItemPayload";
+import type { GetAuthAttempt200ChallengesItemState } from "./getAuthAttempt200ChallengesItemState";
+
+/**
+ * A factor challenge issued within an authentication attempt.
+
+A challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).
+The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ */
+export type GetAuthAttempt200ChallengesItem = {
+  /**
+   * Unique identifier for this challenge
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+  /** An authentication factor method. */
+  method: GetAuthAttempt200ChallengesItemMethod;
+  /** Current state of this challenge:
+  - `pending`: awaiting proof submission
+  - `failed`: proof rejected (invalid credential, wrong code, etc.)
+  - `expired`: challenge TTL exceeded without verification
+   */
+  state: GetAuthAttempt200ChallengesItemState;
+  /** When this challenge was issued */
+  created_at: string;
+  /** When this challenge expires */
+  expires_at?: string | null;
+  /** Method-specific challenge data. Structure depends on the `method` field.
+  - `identifier`, `password`: null (no additional data needed)
+  - `passkey`: WebAuthn challenge and credential options
+  - `idp`: Authorization URL and provider information
+   */
+  payload?: GetAuthAttempt200ChallengesItemPayload;
+};

package/src/generated/model/getAuthAttempt200ChallengesItemMethod.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type GetAuthAttempt200ChallengesItemMethod =
+  (typeof GetAuthAttempt200ChallengesItemMethod)[keyof typeof GetAuthAttempt200ChallengesItemMethod];
+
+export const GetAuthAttempt200ChallengesItemMethod = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;