@zitadel/api 0.1.0-alpha.0 → 0.1.0-alpha.2

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -585,6 +585,41 @@ export const GetUserByIDQueryParams = zod.strictObject({
 
 export const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
 
+/**
+ * @summary Set user password
+ */
+export const setUserPasswordPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const SetUserPasswordParams = zod.object({
+  user_id: zod.string().regex(setUserPasswordPathUserIdRegExp),
+});
+
+export const setUserPasswordQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const SetUserPasswordQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(setUserPasswordQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const SetUserPasswordBody = zod
+  .object({
+    password: zod.string().describe("The new password for the user."),
+    isChangeRequired: zod
+      .boolean()
+      .optional()
+      .describe(
+        "Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n",
+      ),
+  })
+  .describe("Request to update the user's password.");
+
+/**
+ * @summary Get my user information
+ */
+export const GetMyUserResponse = zod.record(zod.string(), zod.unknown());
+
 /**
  * Resolves a flow definition based on purpose + audience context and returns
 the first capability step. Creates a new session implicitly unless
@@ -3146,7 +3181,7 @@ export const ListFlowDefinitionsQueryParams = zod.strictObject({
   project_id: zod
     .string()
     .regex(listFlowDefinitionsQueryProjectIdRegExp)
-    .describe("The unique identifier of the project"),
+    .describe("The project id to filter by."),
   purpose: zod
     .enum(["login", "register", "recovery", "profiling", "reauth", "link_account"])
     .optional()
@@ -3171,6 +3206,7 @@ export const ListFlowDefinitionsResponse = zod.object({
           .describe("Identifier of the project this flow definition belongs to."),
         schema_uri: zod
           .url()
+          .optional()
           .describe(
             "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
           ),
@@ -3200,30 +3236,232 @@ export const GetFlowDefinitionParams = zod.object({
   id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
 });
 
-export const getFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
-export const getFlowDefinitionResponseOneStepsItemFieldsDefault = [];
-export const getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
-export const getFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
-export const getFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
-export const getFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
+export const getFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
+
+export const getFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsPrimaryDefault = false;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = {} as const;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
+
+export const GetFlowDefinitionResponse = zod.object({
+  id: zod.string().describe("Unique identifier for the flow definition."),
+  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
+  status: zod.string().describe("Status of the flow definition."),
+  flow_definition: zod
+    .object({
+      name: zod
+        .string()
+        .regex(getFlowDefinitionResponseFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+        ),
+      user_schema: zod
+        .url()
+        .describe(
+          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+        ),
+      purposes: zod
+        .record(zod.string(), zod.string())
+        .describe(
+          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        ),
+      audience: zod
+        .object({
+          team_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              "Restrict to specific teams (organizations). Empty means no team restriction.",
+            ),
+          app_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe("Restrict to specific applications. Empty means no app restriction."),
+        })
+        .optional()
+        .describe(
+          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+        ),
+      steps: zod
+        .array(
+          zod
+            .object({
+              name: zod
+                .string()
+                .describe(
+                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                ),
+              fields: zod
+                .array(zod.string())
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault)
+                .describe(
+                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                ),
+              actions: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      primary: zod
+                        .boolean()
+                        .default(
+                          getFlowDefinitionResponseFlowDefinitionStepsItemActionsPrimaryDefault,
+                        )
+                        .describe(
+                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                        ),
+                      text_key: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                    ),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
+                .describe(
+                  "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+                ),
+              gates: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      kind: zod
+                        .enum(["captcha"])
+                        .describe(
+                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                        ),
+                      provider: zod
+                        .string()
+                        .describe(
+                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        ),
+                      config: zod
+                        .record(zod.string(), zod.unknown())
+                        .optional()
+                        .describe(
+                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                    ),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault)
+                .describe(
+                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                ),
+              sso_providers: zod
+                .array(
+                  zod
+                    .object({
+                      id: zod.string().describe("Provider instance identifier."),
+                      name: zod.string().describe("Display name for the provider."),
+                      template: zod
+                        .string()
+                        .describe("Template hint for rendering (logo, colors)."),
+                    })
+                    .describe("An available SSO identity provider."),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault)
+                .describe("Available SSO identity providers for this step."),
+              on_success: zod
+                .enum(["create_user"])
+                .optional()
+                .describe(
+                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                ),
+              complete: zod
+                .enum(["redirect", "show"])
+                .optional()
+                .describe(
+                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                ),
+              transitions: zod
+                .record(
+                  zod.string(),
+                  zod.object({
+                    target: zod
+                      .string()
+                      .describe(
+                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                      ),
+                    action: zod
+                      .union([zod.enum(["switch", "pivot"]), zod.null()])
+                      .optional()
+                      .describe(
+                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                      ),
+                  }),
+                )
+                .optional()
+                .describe(
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                ),
+            })
+            .describe(
+              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            ),
+        )
+        .min(1)
+        .describe(
+          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        ),
+    })
+    .describe(
+      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+    ),
+  created_at: zod.iso.datetime({ offset: true }),
+  updated_at: zod.iso.datetime({ offset: true }),
+});
+
+/**
+ * Update a flow definition by id
+ * @summary Update a flow definition by id
+ */
+export const UpdateFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const updateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const UpdateFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(updateFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
+
+export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
+export const updateFlowDefinitionBodyStepsItemActionsPrimaryDefault = false;
+export const updateFlowDefinitionBodyStepsItemActionsDefault = {} as const;
+export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
 
-export const GetFlowDefinitionResponse = zod
+export const UpdateFlowDefinitionBody = zod
   .object({
-    name: zod
-      .string()
-      .regex(getFlowDefinitionResponseOneNameRegExp)
-      .describe(
-        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-      ),
     user_schema: zod
       .url()
-      .describe(
-        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
-      ),
+      .optional()
+      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
     purposes: zod
       .record(zod.string(), zod.string())
+      .optional()
       .describe(
-        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
       ),
     audience: zod
       .object({
@@ -3251,7 +3489,7 @@ export const GetFlowDefinitionResponse = zod
               ),
             fields: zod
               .array(zod.string())
-              .default(getFlowDefinitionResponseOneStepsItemFieldsDefault)
+              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
               .describe(
                 "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
               ),
@@ -3262,7 +3500,7 @@ export const GetFlowDefinitionResponse = zod
                   .object({
                     primary: zod
                       .boolean()
-                      .default(getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
+                      .default(updateFlowDefinitionBodyStepsItemActionsPrimaryDefault)
                       .describe(
                         "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
                       ),
@@ -3277,7 +3515,7 @@ export const GetFlowDefinitionResponse = zod
                     "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
                   ),
               )
-              .default(getFlowDefinitionResponseOneStepsItemActionsDefault)
+              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
               .describe(
                 "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
               ),
@@ -3307,7 +3545,7 @@ export const GetFlowDefinitionResponse = zod
                     "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
                   ),
               )
-              .default(getFlowDefinitionResponseOneStepsItemGatesDefault)
+              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
               .describe(
                 'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
               ),
@@ -3321,7 +3559,7 @@ export const GetFlowDefinitionResponse = zod
                   })
                   .describe("An available SSO identity provider."),
               )
-              .default(getFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
+              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
               .describe("Available SSO identity providers for this step."),
             on_success: zod
               .enum(["create_user"])
@@ -3362,387 +3600,199 @@ export const GetFlowDefinitionResponse = zod
           ),
       )
       .min(1)
+      .optional()
       .describe(
-        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
       ),
   })
   .describe(
-    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-  )
-  .and(
-    zod.object({
-      id: zod.string().describe("Unique identifier for the flow definition."),
-      project_id: zod
+    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
+  );
+
+export const updateFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp(
+  "^[a-z][a-z0-9-]\*$",
+);
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsPrimaryDefault = false;
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = {} as const;
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
+
+export const UpdateFlowDefinitionResponse = zod.object({
+  id: zod.string().describe("Unique identifier for the flow definition."),
+  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
+  status: zod.string().describe("Status of the flow definition."),
+  flow_definition: zod
+    .object({
+      name: zod
         .string()
-        .describe("Identifier of the project this flow definition belongs to."),
-      schema_uri: zod
+        .regex(updateFlowDefinitionResponseFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+        ),
+      user_schema: zod
         .url()
         .describe(
-          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
         ),
-      status: zod.string().describe("Status of the flow definition."),
-      created_at: zod.iso.datetime({ offset: true }),
-      updated_at: zod.iso.datetime({ offset: true }),
-    }),
-  );
-
-/**
- * Update a flow definition by id
- * @summary Update a flow definition by id
- */
-export const UpdateFlowDefinitionParams = zod.object({
-  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
-});
-
-export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
-export const updateFlowDefinitionBodyStepsItemActionsPrimaryDefault = false;
-export const updateFlowDefinitionBodyStepsItemActionsDefault = {} as const;
-export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
-export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
-
-export const UpdateFlowDefinitionBody = zod
-  .object({
-    user_schema: zod
-      .url()
-      .optional()
-      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
-    purposes: zod
-      .record(zod.string(), zod.string())
-      .optional()
-      .describe(
-        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
-      ),
-    audience: zod
-      .object({
-        team_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
-        app_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific applications. Empty means no app restriction."),
-      })
-      .optional()
-      .describe(
-        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-      ),
-    steps: zod
-      .array(
-        zod
-          .object({
-            name: zod
-              .string()
-              .describe(
-                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-              ),
-            fields: zod
-              .array(zod.string())
-              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
-              .describe(
-                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-              ),
-            actions: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    primary: zod
-                      .boolean()
-                      .default(updateFlowDefinitionBodyStepsItemActionsPrimaryDefault)
-                      .describe(
-                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                      ),
-                    text_key: zod
-                      .string()
-                      .optional()
-                      .describe(
-                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
-              .describe(
-                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
-              ),
-            gates: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    kind: zod
-                      .enum(["captcha"])
-                      .describe(
-                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                      ),
-                    provider: zod
-                      .string()
-                      .describe(
-                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
-                      ),
-                    config: zod
-                      .record(zod.string(), zod.unknown())
-                      .optional()
-                      .describe(
-                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
-              .describe(
-                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-              ),
-            sso_providers: zod
-              .array(
-                zod
-                  .object({
-                    id: zod.string().describe("Provider instance identifier."),
-                    name: zod.string().describe("Display name for the provider."),
-                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
-                  })
-                  .describe("An available SSO identity provider."),
-              )
-              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
-              .describe("Available SSO identity providers for this step."),
-            on_success: zod
-              .enum(["create_user"])
-              .optional()
-              .describe(
-                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-              ),
-            complete: zod
-              .enum(["redirect", "show"])
-              .optional()
-              .describe(
-                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-              ),
-            transitions: zod
-              .record(
-                zod.string(),
-                zod.object({
-                  target: zod
-                    .string()
+      purposes: zod
+        .record(zod.string(), zod.string())
+        .describe(
+          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        ),
+      audience: zod
+        .object({
+          team_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              "Restrict to specific teams (organizations). Empty means no team restriction.",
+            ),
+          app_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe("Restrict to specific applications. Empty means no app restriction."),
+        })
+        .optional()
+        .describe(
+          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+        ),
+      steps: zod
+        .array(
+          zod
+            .object({
+              name: zod
+                .string()
+                .describe(
+                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                ),
+              fields: zod
+                .array(zod.string())
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault)
+                .describe(
+                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                ),
+              actions: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      primary: zod
+                        .boolean()
+                        .default(
+                          updateFlowDefinitionResponseFlowDefinitionStepsItemActionsPrimaryDefault,
+                        )
+                        .describe(
+                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                        ),
+                      text_key: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                        ),
+                    })
                     .describe(
-                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                      "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
                     ),
-                  action: zod
-                    .union([zod.enum(["switch", "pivot"]), zod.null()])
-                    .optional()
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
+                .describe(
+                  "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+                ),
+              gates: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      kind: zod
+                        .enum(["captcha"])
+                        .describe(
+                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                        ),
+                      provider: zod
+                        .string()
+                        .describe(
+                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        ),
+                      config: zod
+                        .record(zod.string(), zod.unknown())
+                        .optional()
+                        .describe(
+                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        ),
+                    })
                     .describe(
-                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
                     ),
-                }),
-              )
-              .optional()
-              .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-              ),
-          })
-          .describe(
-            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-          ),
-      )
-      .min(1)
-      .optional()
-      .describe(
-        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
-      ),
-  })
-  .describe(
-    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
-  );
-
-export const updateFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
-export const updateFlowDefinitionResponseOneStepsItemFieldsDefault = [];
-export const updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
-export const updateFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
-export const updateFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
-export const updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
-
-export const UpdateFlowDefinitionResponse = zod
-  .object({
-    name: zod
-      .string()
-      .regex(updateFlowDefinitionResponseOneNameRegExp)
-      .describe(
-        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-      ),
-    user_schema: zod
-      .url()
-      .describe(
-        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
-      ),
-    purposes: zod
-      .record(zod.string(), zod.string())
-      .describe(
-        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
-      ),
-    audience: zod
-      .object({
-        team_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
-        app_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific applications. Empty means no app restriction."),
-      })
-      .optional()
-      .describe(
-        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-      ),
-    steps: zod
-      .array(
-        zod
-          .object({
-            name: zod
-              .string()
-              .describe(
-                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-              ),
-            fields: zod
-              .array(zod.string())
-              .default(updateFlowDefinitionResponseOneStepsItemFieldsDefault)
-              .describe(
-                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-              ),
-            actions: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    primary: zod
-                      .boolean()
-                      .default(updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
-                      .describe(
-                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                      ),
-                    text_key: zod
-                      .string()
-                      .optional()
-                      .describe(
-                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionResponseOneStepsItemActionsDefault)
-              .describe(
-                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
-              ),
-            gates: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    kind: zod
-                      .enum(["captcha"])
-                      .describe(
-                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                      ),
-                    provider: zod
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault)
+                .describe(
+                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                ),
+              sso_providers: zod
+                .array(
+                  zod
+                    .object({
+                      id: zod.string().describe("Provider instance identifier."),
+                      name: zod.string().describe("Display name for the provider."),
+                      template: zod
+                        .string()
+                        .describe("Template hint for rendering (logo, colors)."),
+                    })
+                    .describe("An available SSO identity provider."),
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault)
+                .describe("Available SSO identity providers for this step."),
+              on_success: zod
+                .enum(["create_user"])
+                .optional()
+                .describe(
+                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                ),
+              complete: zod
+                .enum(["redirect", "show"])
+                .optional()
+                .describe(
+                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                ),
+              transitions: zod
+                .record(
+                  zod.string(),
+                  zod.object({
+                    target: zod
                       .string()
                       .describe(
-                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
                       ),
-                    config: zod
-                      .record(zod.string(), zod.unknown())
+                    action: zod
+                      .union([zod.enum(["switch", "pivot"]), zod.null()])
                       .optional()
                       .describe(
-                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
                       ),
-                  })
-                  .describe(
-                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionResponseOneStepsItemGatesDefault)
-              .describe(
-                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-              ),
-            sso_providers: zod
-              .array(
-                zod
-                  .object({
-                    id: zod.string().describe("Provider instance identifier."),
-                    name: zod.string().describe("Display name for the provider."),
-                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
-                  })
-                  .describe("An available SSO identity provider."),
-              )
-              .default(updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
-              .describe("Available SSO identity providers for this step."),
-            on_success: zod
-              .enum(["create_user"])
-              .optional()
-              .describe(
-                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-              ),
-            complete: zod
-              .enum(["redirect", "show"])
-              .optional()
-              .describe(
-                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-              ),
-            transitions: zod
-              .record(
-                zod.string(),
-                zod.object({
-                  target: zod
-                    .string()
-                    .describe(
-                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                    ),
-                  action: zod
-                    .union([zod.enum(["switch", "pivot"]), zod.null()])
-                    .optional()
-                    .describe(
-                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                    ),
-                }),
-              )
-              .optional()
-              .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-              ),
-          })
-          .describe(
-            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-          ),
-      )
-      .min(1)
-      .describe(
-        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
-      ),
-  })
-  .describe(
-    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-  )
-  .and(
-    zod.object({
-      id: zod.string().describe("Unique identifier for the flow definition."),
-      project_id: zod
-        .string()
-        .describe("Identifier of the project this flow definition belongs to."),
-      schema_uri: zod
-        .url()
+                  }),
+                )
+                .optional()
+                .describe(
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                ),
+            })
+            .describe(
+              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            ),
+        )
+        .min(1)
         .describe(
-          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
         ),
-      status: zod.string().describe("Status of the flow definition."),
-      created_at: zod.iso.datetime({ offset: true }),
-      updated_at: zod.iso.datetime({ offset: true }),
-    }),
-  );
+    })
+    .describe(
+      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+    ),
+  created_at: zod.iso.datetime({ offset: true }),
+  updated_at: zod.iso.datetime({ offset: true }),
+});
 
 /**
  * Delete a flow definition by id
@@ -3752,6 +3802,15 @@ export const DeleteFlowDefinitionParams = zod.object({
   id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
 });
 
+export const deleteFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeleteFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(deleteFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
+
 /**
  * @summary Create team
  */