@zitadel/api 0.0.0

package/src/generated/model/getAuthAttempt200ChallengesItemPayload.ts

@@ -0,0 +1,36 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Method-specific challenge data. Structure depends on the `method` field.
+- `identifier`, `password`: null (no additional data needed)
+- `passkey`: WebAuthn challenge and credential options
+- `idp`: Authorization URL and provider information
+
+ */
+export type GetAuthAttempt200ChallengesItemPayload =
+  | { [key: string]: unknown }
+  | {
+      /** Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).
+  See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialrequestoptions
+   */
+      public_key: {
+        /** Base64-encoded WebAuthn challenge */
+        challenge: string;
+        /** List of credential IDs that can be used for this authentication */
+        allowed_credentials?: {
+          /** Base64-encoded credential ID */
+          id: string;
+          type: "public-key";
+        }[];
+        /** User verification requirement for this challenge */
+        user_verification?: "required" | "preferred" | "discouraged";
+        /** Relying Party ID for WebAuthn */
+        rp_id?: string;
+      };
+    };

package/src/generated/model/getAuthAttempt200ChallengesItemState.ts

@@ -0,0 +1,23 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Current state of this challenge:
+- `pending`: awaiting proof submission
+- `failed`: proof rejected (invalid credential, wrong code, etc.)
+- `expired`: challenge TTL exceeded without verification
+
+ */
+export type GetAuthAttempt200ChallengesItemState =
+  (typeof GetAuthAttempt200ChallengesItemState)[keyof typeof GetAuthAttempt200ChallengesItemState];
+
+export const GetAuthAttempt200ChallengesItemState = {
+  pending: "pending",
+  failed: "failed",
+  expired: "expired",
+} as const;

package/src/generated/model/getAuthAttempt200CompletedFactorsItem.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetAuthAttempt200CompletedFactorsItemMethod } from "./getAuthAttempt200CompletedFactorsItemMethod";
+import type { GetAuthAttempt200CompletedFactorsItemPayload } from "./getAuthAttempt200CompletedFactorsItemPayload";
+
+/**
+ * A successfully verified authentication factor with verification metadata.
+Method-specific details are included in the `payload` field.
+
+ */
+export type GetAuthAttempt200CompletedFactorsItem = {
+  /** An authentication factor method. */
+  method: GetAuthAttempt200CompletedFactorsItemMethod;
+  /** When this factor was successfully verified */
+  verified_at: string;
+  /** Method-specific factor metadata. Structure depends on the `method` field.
+  - `identifier`: includes user_id
+  - `password`: no additional data
+  - `passkey`: includes credential details and verification flags
+   */
+  payload?: GetAuthAttempt200CompletedFactorsItemPayload;
+};

package/src/generated/model/getAuthAttempt200CompletedFactorsItemMethod.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type GetAuthAttempt200CompletedFactorsItemMethod =
+  (typeof GetAuthAttempt200CompletedFactorsItemMethod)[keyof typeof GetAuthAttempt200CompletedFactorsItemMethod];
+
+export const GetAuthAttempt200CompletedFactorsItemMethod = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/getAuthAttempt200CompletedFactorsItemPayload.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Method-specific factor metadata. Structure depends on the `method` field.
+- `identifier`: includes user_id
+- `password`: no additional data
+- `passkey`: includes credential details and verification flags
+
+ */
+export type GetAuthAttempt200CompletedFactorsItemPayload =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      user_id: string;
+    }
+  | { [key: string]: unknown }
+  | {
+      /** The credential ID that was used */
+      credential_id: string;
+      /** Whether user verification was performed (PIN/biometric) */
+      user_verified: boolean;
+      /** Whether the credential is backup eligible (can be synced) */
+      backup_eligible?: boolean;
+      /** Whether the credential is currently backed up */
+      backup_state?: boolean;
+      /** Authenticator attachment modality */
+      authenticator_attachment?: "platform" | "cross-platform";
+    };

package/src/generated/model/getAuthAttempt200RequiredFactorsItem.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * An authentication factor method.
+ */
+export type GetAuthAttempt200RequiredFactorsItem =
+  (typeof GetAuthAttempt200RequiredFactorsItem)[keyof typeof GetAuthAttempt200RequiredFactorsItem];
+
+export const GetAuthAttempt200RequiredFactorsItem = {
+  identifier: "identifier",
+  password: "password",
+  passkey: "passkey",
+} as const;

package/src/generated/model/getAuthAttempt200State.ts

@@ -0,0 +1,25 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Overall state of the authentication attempt:
+- `in_progress`: factors are still being collected; continue issuing challenges.
+- `completed`: all required factors have been verified; the attempt is ready for handoff.
+- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+- `expired`: the 15-minute TTL has been exceeded.
+
+ */
+export type GetAuthAttempt200State =
+  (typeof GetAuthAttempt200State)[keyof typeof GetAuthAttempt200State];
+
+export const GetAuthAttempt200State = {
+  in_progress: "in_progress",
+  completed: "completed",
+  failed: "failed",
+  expired: "expired",
+} as const;

package/src/generated/model/getAuthAttemptDefault.ts

@@ -0,0 +1,29 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type GetAuthAttemptDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    });

package/src/generated/model/getFlowDefinition200.ts

@@ -0,0 +1,162 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type GetFlowDefinition200 = {
+  /**
+     * Stable identifier for this flow, used as the target of cross-flow
+  `switch` and `pivot` transitions. Renaming is not supported — the
+  `name` is part of the public contract another definition may
+  reference. Acts as the human display label as well; no separate slug.
+
+     * @pattern ^[a-z][a-z0-9-]*$
+     */
+  name: string;
+  /** User schema this flow operates on. Step `fields` reference properties
+  defined in this schema. The engine resolves field types, validation,
+  and implicit outcomes from schema annotations at runtime.
+   */
+  user_schema: string;
+  /** Maps each purpose this definition handles to its entry-point step.
+  Keys are purpose names; values must match a `name` in `steps`. A
+  definition can serve multiple purposes (e.g. a combined login/register
+  flow) by listing one entry per purpose.
+   */
+  purposes: Partial<
+    Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>
+  >;
+  /** Scopes which teams or apps this flow definition applies to. Empty or
+  omitted fields mean "no restriction"; when both are empty the definition
+  matches every request in the project. The engine picks the most specific
+  matching definition: app > team > project-wide.
+   */
+  audience?: {
+    /** Restrict to specific teams (organizations). Empty means no team restriction. */
+    team_ids?: string[];
+    /** Restrict to specific applications. Empty means no app restriction. */
+    app_ids?: string[];
+  };
+  /**
+     * Ordered list of steps in this flow. The order is for human readability —
+  actual step sequencing is determined by transitions.
+
+     * @minItems 1
+     */
+  steps: {
+    /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+    name: string;
+    /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+    fields?: string[];
+    /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+    actions?: {
+      [key: string]: {
+        /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+        primary?: boolean;
+        /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+        text_key?: string;
+      };
+    };
+    /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+    gates?: {
+      [key: string]: {
+        /** The gate category. Only `captcha` is currently defined. Authenticator
+  ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+  `x-credential` on a field, not as gates.
+   */
+        kind: "captcha";
+        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+  `hcaptcha`. The engine looks up an implementation in its provider
+  registry.
+   */
+        provider: string;
+        /** Provider-specific configuration consumed by the implementation when
+  issuing the per-render challenge. Opaque to the engine.
+   */
+        config?: { [key: string]: unknown };
+      };
+    };
+    /** Available SSO identity providers for this step. */
+    sso_providers?: {
+      /** Provider instance identifier. */
+      id: string;
+      /** Display name for the provider. */
+      name: string;
+      /** Template hint for rendering (logo, colors). */
+      template: string;
+    }[];
+    /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+
+  - create_user: creates the user record (registration flows)
+   */
+    on_success?: "create_user";
+    /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+    complete?: "redirect" | "show";
+    /** Maps action/outcome names to their transition descriptor.
+
+  Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+    transitions?: {
+      [key: string]: {
+        /** Step name within this flow (when `action` is null), or the name
+  of another flow (when `action` is `switch` or `pivot`).
+   */
+        target: string;
+        /** How to interpret `target`:
+  - null (omitted): transition to a step in the current flow.
+  - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+  - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+   */
+        action?: "switch" | "pivot" | null;
+      };
+    };
+  }[];
+} & {
+  /** Unique identifier for the flow definition. */
+  id: string;
+  /** Identifier of the project this flow definition belongs to. */
+  project_id: string;
+  /** URI of the flow definition schema this definition was authored against.
+  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
+   */
+  schema_uri: string;
+  /** Status of the flow definition. */
+  status: string;
+  created_at: string;
+  updated_at: string;
+};

package/src/generated/model/getFlowDefinition404.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetFlowDefinition404Details } from "./getFlowDefinition404Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetFlowDefinition404 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetFlowDefinition404Details;
+};

package/src/generated/model/getFlowDefinition404Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetFlowDefinition404Details = { [key: string]: unknown };

package/src/generated/model/getFlowDefinitionDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetFlowDefinitionDefaultDetails } from "./getFlowDefinitionDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetFlowDefinitionDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetFlowDefinitionDefaultDetails;
+};

package/src/generated/model/getFlowDefinitionDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetFlowDefinitionDefaultDetails = { [key: string]: unknown };

package/src/generated/model/getFlowStep200.ts

@@ -0,0 +1,42 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetFlowStep200Branding } from "./getFlowStep200Branding";
+import type { GetFlowStep200Step } from "./getFlowStep200Step";
+
+export type GetFlowStep200 = {
+  /** Flow handle. Use this as the path parameter for subsequent
+  submit/event calls. May change between responses when a
+  flow pivot or pop occurs.
+   */
+  id: string;
+  /** Underlying session ID. Stable across all stacked flows. */
+  session_id: string;
+  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
+  session_token?: string;
+  /** A step contains unordered capability dictionaries: what to collect (fields),
+  what the user can do (actions), and what security gates must be satisfied (gates).
+  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+   */
+  step: GetFlowStep200Step;
+  /** Resolved branding configuration. Inherited from the app → team → project
+  hierarchy at flow creation time (most specific wins). Read-only projection —
+  branding is configured via the Team/App Branding API, not the Flow API.
+   */
+  branding?: GetFlowStep200Branding;
+  /** Present when `step.complete` is `redirect`. */
+  redirect_uri?: string;
+  /** Short-lived, audience-bound token produced on flow completion.
+  Exchange it for a session via `POST /sessions/exchange`.
+  Only present when `step.complete` is set.
+   */
+  handoff_token?: string;
+  /** Expiry timestamp for `handoff_token`. Only present when
+  `handoff_token` is set.
+   */
+  handoff_token_expires_at?: string;
+};

package/src/generated/model/getFlowStep200Branding.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetFlowStep200BrandingLayout } from "./getFlowStep200BrandingLayout";
+
+/**
+ * Resolved branding configuration. Inherited from the app → team → project
+hierarchy at flow creation time (most specific wins). Read-only projection —
+branding is configured via the Team/App Branding API, not the Flow API.
+
+ */
+export type GetFlowStep200Branding = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely.
+   */
+  layout?: GetFlowStep200BrandingLayout;
+  /** The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+   */
+  liquid_template?: string;
+  /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font URL (e.g., Google Fonts CSS). */
+  font_url?: string;
+  /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+};

package/src/generated/model/getFlowStep200BrandingLayout.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely.
+
+ */
+export type GetFlowStep200BrandingLayout =
+  (typeof GetFlowStep200BrandingLayout)[keyof typeof GetFlowStep200BrandingLayout];
+
+export const GetFlowStep200BrandingLayout = {
+  centered: "centered",
+  split: "split",
+} as const;

package/src/generated/model/getFlowStep200Step.ts

@@ -0,0 +1,64 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetFlowStep200StepActions } from "./getFlowStep200StepActions";
+import type { GetFlowStep200StepChallenge } from "./getFlowStep200StepChallenge";
+import type { GetFlowStep200StepComplete } from "./getFlowStep200StepComplete";
+import type { GetFlowStep200StepFields } from "./getFlowStep200StepFields";
+import type { GetFlowStep200StepGates } from "./getFlowStep200StepGates";
+import type { GetFlowStep200StepSsoProvidersItem } from "./getFlowStep200StepSsoProvidersItem";
+import type { GetFlowStep200StepTexts } from "./getFlowStep200StepTexts";
+
+/**
+ * A step contains unordered capability dictionaries: what to collect (fields),
+what the user can do (actions), and what security gates must be satisfied (gates).
+Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+
+ */
+export type GetFlowStep200Step = {
+  /** Step name from the flow definition. */
+  name: string;
+  /** Step-level localization keys. Resolved client-side via the `| t` LiquidJS filter.
+  The backend never sends display text — only semantic keys.
+   */
+  texts?: GetFlowStep200StepTexts;
+  /** Error message from a previous failed submission. */
+  error?: string | null;
+  /** Present only on terminal steps. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri immediately (OIDC/SAML done)
+  - show: render the step as a success screen (e.g., registration confirmed)
+   */
+  complete?: GetFlowStep200StepComplete;
+  /** URL to navigate to (e.g., SSO provider redirect). */
+  redirect_url?: string;
+  /** Unordered dictionary of input fields to collect. Keyed by field name.
+  The LiquidJS template controls which fields appear and in what order.
+  Field metadata (type, validation) is resolved by the engine from the
+  flow's user schema.
+   */
+  fields: GetFlowStep200StepFields;
+  /** Unordered dictionary of available user actions. Keyed by action name.
+  The LiquidJS template controls positioning and presentation.
+   */
+  actions: GetFlowStep200StepActions;
+  /** Security gates that must be satisfied before the step can be submitted.
+  The engine injects gates dynamically based on policy, even if they
+  are not declared in the flow definition.
+   */
+  gates: GetFlowStep200StepGates;
+  /** Available SSO identity providers for this step. */
+  sso_providers?: GetFlowStep200StepSsoProvidersItem[];
+  /** A pending authentication challenge issued by the server. Present when the
+  flow engine has issued a challenge via auth_attempts (e.g., after the user
+  submits `action: "passkey"`). The `<zl-passkey>` component reads this and
+  triggers the appropriate WebAuthn ceremony.
+
+  The challenge is NOT present on the initial step — it appears only after
+  the user explicitly selects a ceremony-based action.
+   */
+  challenge?: GetFlowStep200StepChallenge;
+};

package/src/generated/model/getFlowStep200StepActions.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Unordered dictionary of available user actions. Keyed by action name.
+The LiquidJS template controls positioning and presentation.
+
+ */
+export type GetFlowStep200StepActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+    text_key?: string;
+  };
+};