@zitadel/api 0.1.0-alpha.10 → 0.1.0-alpha.12

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -481,7 +481,7 @@ export const GetKeysResponse = zod.object({
 });
 
 /**
- * @summary Get accesstoken
+ * @summary Get access token
  */
 export const GetTokenResponse = zod.object({
   access_token: zod
@@ -637,6 +637,7 @@ cookie. The browser sends it automatically on subsequent requests.
  */
 export const createFlowBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const createFlowBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const createFlowBodyDryRunDefault = false;
 export const createFlowBodySchemaVersionRegExp = new RegExp("^\\d+\\.\\d+\\.\\d+$");
 
 export const CreateFlowBody = zod.object({
@@ -649,6 +650,12 @@ export const CreateFlowBody = zod.object({
     .describe(
       "Name of a specific flow definition to use.\nWhen omitted, the engine selects the best-matching definition\nbased on purpose + audience context.\n",
     ),
+  dry_run: zod
+    .boolean()
+    .default(createFlowBodyDryRunDefault)
+    .describe(
+      "Set to true to simulate the flow without actually creating any\nuser or session. Useful for testing and validation of flow definitions.\nThis requires setting the `flow_definition_name` property as well.\n",
+    ),
   schema_version: zod
     .string()
     .regex(createFlowBodySchemaVersionRegExp)
@@ -835,6 +842,11 @@ export const GetFlowStepResponse = zod.object({
               name: zod
                 .string()
                 .describe("Action identifier. Sent back in the submit request as `action`."),
+              kind: zod
+                .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                .describe(
+                  "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                ),
               primary: zod
                 .boolean()
                 .default(getFlowStepResponseStepActionsItemPrimaryDefault)
@@ -849,7 +861,7 @@ export const GetFlowStepResponse = zod.object({
                 ),
             })
             .describe(
-              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
             ),
         )
         .default(getFlowStepResponseStepActionsDefault)
@@ -1196,6 +1208,11 @@ export const SubmitFlowStepResponse = zod.object({
               name: zod
                 .string()
                 .describe("Action identifier. Sent back in the submit request as `action`."),
+              kind: zod
+                .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                .describe(
+                  "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                ),
               primary: zod
                 .boolean()
                 .default(submitFlowStepResponseStepActionsItemPrimaryDefault)
@@ -1210,7 +1227,7 @@ export const SubmitFlowStepResponse = zod.object({
                 ),
             })
             .describe(
-              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
             ),
         )
         .default(submitFlowStepResponseStepActionsDefault)
@@ -3010,199 +3027,215 @@ export const GetSchemaByIdResponse = zod
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
-Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
  * @summary Create a new flow definition
  */
 export const createFlowDefinitionBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const createFlowDefinitionBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const createFlowDefinitionBodyFlowDefinitionStatusDefault = `active`;
 export const createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
 export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
 export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault = [];
 export const createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault = {} as const;
 export const createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault = [];
 
-export const CreateFlowDefinitionBody = zod.object({
-  project_id: zod.string().regex(createFlowDefinitionBodyProjectIdRegExp),
-  schema_uri: zod
-    .url()
-    .optional()
-    .describe(
-      "URI of the server-published flow definition schema this definition was\nauthored against. The server uses this to validate the definition.\nIf not provided, the engine will use the latest schema version for validation.\n",
-    ),
-  flow_definition: zod
-    .object({
-      name: zod
-        .string()
-        .regex(createFlowDefinitionBodyFlowDefinitionNameRegExp)
-        .describe(
-          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-        ),
-      user_schema: zod
-        .url()
-        .describe(
-          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
-        ),
-      purposes: zod
-        .record(zod.string(), zod.string())
-        .describe(
-          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
-        ),
-      audience: zod
-        .object({
-          team_ids: zod
-            .array(zod.string())
-            .optional()
-            .describe(
-              "Restrict to specific teams (organizations). Empty means no team restriction.",
-            ),
-          app_ids: zod
-            .array(zod.string())
-            .optional()
-            .describe("Restrict to specific applications. Empty means no app restriction."),
-        })
-        .optional()
-        .describe(
-          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-        ),
-      steps: zod
-        .array(
-          zod
-            .object({
-              name: zod
-                .string()
-                .describe(
-                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-                ),
-              fields: zod
-                .array(zod.string())
-                .default(createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault)
-                .describe(
-                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-                ),
-              actions: zod
-                .array(
-                  zod
-                    .object({
-                      name: zod
-                        .string()
-                        .describe(
-                          "Action identifier. Sent back in the submit request as `action`.",
-                        ),
-                      primary: zod
-                        .boolean()
-                        .default(
-                          createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault,
-                        )
-                        .describe(
-                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                        ),
-                      text_key: zod
-                        .string()
-                        .optional()
-                        .describe(
-                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                        ),
-                    })
-                    .describe(
-                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
-                    ),
-                )
-                .default(createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault)
-                .describe(
-                  "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
-                ),
-              gates: zod
-                .record(
-                  zod.string(),
-                  zod
-                    .object({
-                      kind: zod
-                        .enum(["captcha"])
-                        .describe(
-                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                        ),
-                      provider: zod
+export const CreateFlowDefinitionBody = zod
+  .object({
+    project_id: zod.string().regex(createFlowDefinitionBodyProjectIdRegExp),
+    schema_uri: zod
+      .url()
+      .optional()
+      .describe(
+        "URI of the server-published flow definition schema this definition was\nauthored against. The server uses this to validate the definition.\nIf not provided, the engine will use the latest schema version for validation.\n",
+      ),
+    flow_definition: zod
+      .object({
+        name: zod
+          .string()
+          .regex(createFlowDefinitionBodyFlowDefinitionNameRegExp)
+          .describe(
+            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+          ),
+        status: zod
+          .enum(["active", "draft"])
+          .default(createFlowDefinitionBodyFlowDefinitionStatusDefault)
+          .describe(
+            "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+          ),
+        user_schema: zod
+          .url()
+          .describe(
+            "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+          ),
+        purposes: zod
+          .record(zod.string(), zod.string())
+          .describe(
+            "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+          ),
+        audience: zod
+          .object({
+            team_ids: zod
+              .array(zod.string())
+              .optional()
+              .describe(
+                "Restrict to specific teams (organizations). Empty means no team restriction.",
+              ),
+            app_ids: zod
+              .array(zod.string())
+              .optional()
+              .describe("Restrict to specific applications. Empty means no app restriction."),
+          })
+          .optional()
+          .describe(
+            'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+          ),
+        steps: zod
+          .array(
+            zod
+              .object({
+                name: zod
+                  .string()
+                  .describe(
+                    "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                  ),
+                fields: zod
+                  .array(zod.string())
+                  .default(createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault)
+                  .describe(
+                    "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                  ),
+                actions: zod
+                  .array(
+                    zod
+                      .object({
+                        name: zod
+                          .string()
+                          .describe(
+                            "Action identifier. Sent back in the submit request as `action`.",
+                          ),
+                        kind: zod
+                          .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                          .describe(
+                            "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                          ),
+                        primary: zod
+                          .boolean()
+                          .default(
+                            createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault,
+                          )
+                          .describe(
+                            "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                          ),
+                        text_key: zod
+                          .string()
+                          .optional()
+                          .describe(
+                            "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                          ),
+                      })
+                      .describe(
+                        "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
+                      ),
+                  )
+                  .default(createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault)
+                  .describe(
+                    "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+                  ),
+                gates: zod
+                  .record(
+                    zod.string(),
+                    zod
+                      .object({
+                        kind: zod
+                          .enum(["captcha"])
+                          .describe(
+                            "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                          ),
+                        provider: zod
+                          .string()
+                          .describe(
+                            "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                          ),
+                        config: zod
+                          .record(zod.string(), zod.unknown())
+                          .optional()
+                          .describe(
+                            "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                          ),
+                      })
+                      .describe(
+                        "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                      ),
+                  )
+                  .default(createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault)
+                  .describe(
+                    'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                  ),
+                sso_providers: zod
+                  .array(
+                    zod
+                      .object({
+                        id: zod.string().describe("Provider instance identifier."),
+                        name: zod.string().describe("Display name for the provider."),
+                        template: zod
+                          .string()
+                          .describe("Template hint for rendering (logo, colors)."),
+                      })
+                      .describe("An available SSO identity provider."),
+                  )
+                  .default(createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault)
+                  .describe("Available SSO identity providers for this step."),
+                on_success: zod
+                  .enum(["create_user"])
+                  .optional()
+                  .describe(
+                    "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                  ),
+                complete: zod
+                  .enum(["redirect", "show"])
+                  .optional()
+                  .describe(
+                    "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                  ),
+                transitions: zod
+                  .record(
+                    zod.string(),
+                    zod.object({
+                      target: zod
                         .string()
                         .describe(
-                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                          "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
                         ),
-                      config: zod
-                        .record(zod.string(), zod.unknown())
+                      action: zod
+                        .union([zod.enum(["switch", "pivot"]), zod.null()])
                         .optional()
                         .describe(
-                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                          "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
                         ),
-                    })
-                    .describe(
-                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                    ),
-                )
-                .default(createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault)
-                .describe(
-                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-                ),
-              sso_providers: zod
-                .array(
-                  zod
-                    .object({
-                      id: zod.string().describe("Provider instance identifier."),
-                      name: zod.string().describe("Display name for the provider."),
-                      template: zod
-                        .string()
-                        .describe("Template hint for rendering (logo, colors)."),
-                    })
-                    .describe("An available SSO identity provider."),
-                )
-                .default(createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault)
-                .describe("Available SSO identity providers for this step."),
-              on_success: zod
-                .enum(["create_user"])
-                .optional()
-                .describe(
-                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-                ),
-              complete: zod
-                .enum(["redirect", "show"])
-                .optional()
-                .describe(
-                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-                ),
-              transitions: zod
-                .record(
-                  zod.string(),
-                  zod.object({
-                    target: zod
-                      .string()
-                      .describe(
-                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                      ),
-                    action: zod
-                      .union([zod.enum(["switch", "pivot"]), zod.null()])
-                      .optional()
-                      .describe(
-                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                      ),
-                  }),
-                )
-                .optional()
-                .describe(
-                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-                ),
-            })
-            .describe(
-              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-            ),
-        )
-        .min(1)
-        .describe(
-          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
-        ),
-    })
-    .describe(
-      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-    ),
-});
+                    }),
+                  )
+                  .optional()
+                  .describe(
+                    "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                  ),
+              })
+              .describe(
+                "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+              ),
+          )
+          .min(1)
+          .describe(
+            "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+          ),
+      })
+      .describe(
+        "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+      ),
+  })
+  .describe(
+    "Creates a flow definition.\nThe flow definition is created in an `active` state by default.\nThe status can also be set via the `status` attribute in the flow definition payload.\n",
+  );
 
 /**
  * Retrieves a list of all flow definitions.
@@ -3241,6 +3274,7 @@ export const ListFlowDefinitionsQueryParams = zod.strictObject({
 export const listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp = new RegExp(
   "^[a-z][a-z0-9-]\*$",
 );
+export const listFlowDefinitionsResponseFlowDefinitionsItemStatusDefault = `active`;
 
 export const ListFlowDefinitionsResponse = zod.object({
   flow_definitions: zod.array(
@@ -3260,7 +3294,12 @@ export const ListFlowDefinitionsResponse = zod.object({
           .describe(
             "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
           ),
-        status: zod.string().describe("Status of the flow definition."),
+        status: zod
+          .enum(["active", "draft"])
+          .default(listFlowDefinitionsResponseFlowDefinitionsItemStatusDefault)
+          .describe(
+            "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+          ),
         created_at: zod.iso
           .datetime({ offset: true })
           .describe("Timestamp when the flow definition was created."),
@@ -3295,7 +3334,9 @@ export const GetFlowDefinitionQueryParams = zod.strictObject({
     .describe("The project id to filter by."),
 });
 
+export const getFlowDefinitionResponseStatusDefault = `active`;
 export const getFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const getFlowDefinitionResponseFlowDefinitionStatusDefault = `active`;
 export const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
 export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
 export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
@@ -3305,7 +3346,12 @@ export const getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault
 export const GetFlowDefinitionResponse = zod.object({
   id: zod.string().describe("Unique identifier for the flow definition."),
   project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
-  status: zod.string().describe("Status of the flow definition."),
+  status: zod
+    .enum(["active", "draft"])
+    .default(getFlowDefinitionResponseStatusDefault)
+    .describe(
+      "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+    ),
   flow_definition: zod
     .object({
       name: zod
@@ -3314,6 +3360,12 @@ export const GetFlowDefinitionResponse = zod.object({
         .describe(
           "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
         ),
+      status: zod
+        .enum(["active", "draft"])
+        .default(getFlowDefinitionResponseFlowDefinitionStatusDefault)
+        .describe(
+          "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+        ),
       user_schema: zod
         .url()
         .describe(
@@ -3365,6 +3417,11 @@ export const GetFlowDefinitionResponse = zod.object({
                         .describe(
                           "Action identifier. Sent back in the submit request as `action`.",
                         ),
+                      kind: zod
+                        .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                        .describe(
+                          "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                        ),
                       primary: zod
                         .boolean()
                         .default(
@@ -3381,7 +3438,7 @@ export const GetFlowDefinitionResponse = zod.object({
                         ),
                     })
                     .describe(
-                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
                     ),
                 )
                 .default(getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
@@ -3483,7 +3540,9 @@ export const GetFlowDefinitionResponse = zod.object({
 });
 
 /**
- * Update a flow definition by id
+ * Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
  * @summary Update a flow definition by id
  */
 export const UpdateFlowDefinitionParams = zod.object({
@@ -3499,175 +3558,215 @@ export const UpdateFlowDefinitionQueryParams = zod.strictObject({
     .describe("The project id to filter by."),
 });
 
-export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
-export const updateFlowDefinitionBodyStepsItemActionsItemPrimaryDefault = false;
-export const updateFlowDefinitionBodyStepsItemActionsDefault = [];
-export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
-export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
+export const updateFlowDefinitionBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const updateFlowDefinitionBodyFlowDefinitionStatusDefault = `active`;
+export const updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
+export const updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
+export const updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault = [];
+export const updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault = [];
 
 export const UpdateFlowDefinitionBody = zod
   .object({
-    user_schema: zod
+    schema_uri: zod
       .url()
       .optional()
-      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
-    purposes: zod
-      .record(zod.string(), zod.string())
-      .optional()
       .describe(
-        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
+        "URI of the server-published flow definition schema this definition was\nauthored against. The server uses this to validate the definition.\nIf not provided, the engine will use the latest schema version for validation.\n",
       ),
-    audience: zod
+    flow_definition: zod
       .object({
-        team_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
-        app_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific applications. Empty means no app restriction."),
-      })
-      .optional()
-      .describe(
-        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-      ),
-    steps: zod
-      .array(
-        zod
+        name: zod
+          .string()
+          .regex(updateFlowDefinitionBodyFlowDefinitionNameRegExp)
+          .describe(
+            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+          ),
+        status: zod
+          .enum(["active", "draft"])
+          .default(updateFlowDefinitionBodyFlowDefinitionStatusDefault)
+          .describe(
+            "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+          ),
+        user_schema: zod
+          .url()
+          .describe(
+            "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+          ),
+        purposes: zod
+          .record(zod.string(), zod.string())
+          .describe(
+            "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+          ),
+        audience: zod
           .object({
-            name: zod
-              .string()
-              .describe(
-                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-              ),
-            fields: zod
+            team_ids: zod
               .array(zod.string())
-              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
+              .optional()
               .describe(
-                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                "Restrict to specific teams (organizations). Empty means no team restriction.",
               ),
-            actions: zod
-              .array(
-                zod
-                  .object({
-                    name: zod
-                      .string()
-                      .describe("Action identifier. Sent back in the submit request as `action`."),
-                    primary: zod
-                      .boolean()
-                      .default(updateFlowDefinitionBodyStepsItemActionsItemPrimaryDefault)
-                      .describe(
-                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                      ),
-                    text_key: zod
-                      .string()
-                      .optional()
-                      .describe(
-                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                      ),
-                  })
+            app_ids: zod
+              .array(zod.string())
+              .optional()
+              .describe("Restrict to specific applications. Empty means no app restriction."),
+          })
+          .optional()
+          .describe(
+            'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+          ),
+        steps: zod
+          .array(
+            zod
+              .object({
+                name: zod
+                  .string()
                   .describe(
-                    "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+                    "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
                   ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
-              .describe(
-                "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
-              ),
-            gates: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    kind: zod
-                      .enum(["captcha"])
-                      .describe(
-                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                      ),
-                    provider: zod
-                      .string()
+                fields: zod
+                  .array(zod.string())
+                  .default(updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault)
+                  .describe(
+                    "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                  ),
+                actions: zod
+                  .array(
+                    zod
+                      .object({
+                        name: zod
+                          .string()
+                          .describe(
+                            "Action identifier. Sent back in the submit request as `action`.",
+                          ),
+                        kind: zod
+                          .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                          .describe(
+                            "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                          ),
+                        primary: zod
+                          .boolean()
+                          .default(
+                            updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault,
+                          )
+                          .describe(
+                            "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                          ),
+                        text_key: zod
+                          .string()
+                          .optional()
+                          .describe(
+                            "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                          ),
+                      })
                       .describe(
-                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
                       ),
-                    config: zod
-                      .record(zod.string(), zod.unknown())
-                      .optional()
+                  )
+                  .default(updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault)
+                  .describe(
+                    "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+                  ),
+                gates: zod
+                  .record(
+                    zod.string(),
+                    zod
+                      .object({
+                        kind: zod
+                          .enum(["captcha"])
+                          .describe(
+                            "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                          ),
+                        provider: zod
+                          .string()
+                          .describe(
+                            "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                          ),
+                        config: zod
+                          .record(zod.string(), zod.unknown())
+                          .optional()
+                          .describe(
+                            "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                          ),
+                      })
                       .describe(
-                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
                       ),
-                  })
+                  )
+                  .default(updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault)
                   .describe(
-                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                    'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
                   ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
-              .describe(
-                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-              ),
-            sso_providers: zod
-              .array(
-                zod
-                  .object({
-                    id: zod.string().describe("Provider instance identifier."),
-                    name: zod.string().describe("Display name for the provider."),
-                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
-                  })
-                  .describe("An available SSO identity provider."),
-              )
-              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
-              .describe("Available SSO identity providers for this step."),
-            on_success: zod
-              .enum(["create_user"])
-              .optional()
-              .describe(
-                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-              ),
-            complete: zod
-              .enum(["redirect", "show"])
-              .optional()
-              .describe(
-                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-              ),
-            transitions: zod
-              .record(
-                zod.string(),
-                zod.object({
-                  target: zod
-                    .string()
-                    .describe(
-                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                    ),
-                  action: zod
-                    .union([zod.enum(["switch", "pivot"]), zod.null()])
-                    .optional()
-                    .describe(
-                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                    ),
-                }),
-              )
-              .optional()
+                sso_providers: zod
+                  .array(
+                    zod
+                      .object({
+                        id: zod.string().describe("Provider instance identifier."),
+                        name: zod.string().describe("Display name for the provider."),
+                        template: zod
+                          .string()
+                          .describe("Template hint for rendering (logo, colors)."),
+                      })
+                      .describe("An available SSO identity provider."),
+                  )
+                  .default(updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault)
+                  .describe("Available SSO identity providers for this step."),
+                on_success: zod
+                  .enum(["create_user"])
+                  .optional()
+                  .describe(
+                    "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                  ),
+                complete: zod
+                  .enum(["redirect", "show"])
+                  .optional()
+                  .describe(
+                    "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                  ),
+                transitions: zod
+                  .record(
+                    zod.string(),
+                    zod.object({
+                      target: zod
+                        .string()
+                        .describe(
+                          "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                        ),
+                      action: zod
+                        .union([zod.enum(["switch", "pivot"]), zod.null()])
+                        .optional()
+                        .describe(
+                          "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                        ),
+                    }),
+                  )
+                  .optional()
+                  .describe(
+                    "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                  ),
+              })
               .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
               ),
-          })
+          )
+          .min(1)
           .describe(
-            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
           ),
-      )
-      .min(1)
-      .optional()
+      })
       .describe(
-        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
+        "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
       ),
   })
   .describe(
-    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
+    "Replaces the existing flow definition.\nIf `flow_definition.status` is omitted, the current status is preserved\n",
   );
 
+export const updateFlowDefinitionResponseStatusDefault = `active`;
 export const updateFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp(
   "^[a-z][a-z0-9-]\*$",
 );
+export const updateFlowDefinitionResponseFlowDefinitionStatusDefault = `active`;
 export const updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
 export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
 export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
@@ -3677,7 +3776,12 @@ export const updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefa
 export const UpdateFlowDefinitionResponse = zod.object({
   id: zod.string().describe("Unique identifier for the flow definition."),
   project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
-  status: zod.string().describe("Status of the flow definition."),
+  status: zod
+    .enum(["active", "draft"])
+    .default(updateFlowDefinitionResponseStatusDefault)
+    .describe(
+      "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+    ),
   flow_definition: zod
     .object({
       name: zod
@@ -3686,6 +3790,12 @@ export const UpdateFlowDefinitionResponse = zod.object({
         .describe(
           "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
         ),
+      status: zod
+        .enum(["active", "draft"])
+        .default(updateFlowDefinitionResponseFlowDefinitionStatusDefault)
+        .describe(
+          "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+        ),
       user_schema: zod
         .url()
         .describe(
@@ -3737,6 +3847,11 @@ export const UpdateFlowDefinitionResponse = zod.object({
                         .describe(
                           "Action identifier. Sent back in the submit request as `action`.",
                         ),
+                      kind: zod
+                        .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                        .describe(
+                          "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                        ),
                       primary: zod
                         .boolean()
                         .default(
@@ -3753,7 +3868,7 @@ export const UpdateFlowDefinitionResponse = zod.object({
                         ),
                     })
                     .describe(
-                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
                     ),
                 )
                 .default(updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
@@ -3855,7 +3970,10 @@ export const UpdateFlowDefinitionResponse = zod.object({
 });
 
 /**
- * Delete a flow definition by id
+ * Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
  * @summary Delete a flow definition by id
  */
 export const DeleteFlowDefinitionParams = zod.object({
@@ -3871,6 +3989,45 @@ export const DeleteFlowDefinitionQueryParams = zod.strictObject({
     .describe("The project id to filter by."),
 });
 
+/**
+ * Activate a flow definition by transitioning it from a `draft` state to an `active` state.
+Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+
+ * @summary Activate a flow definition by ID.
+ */
+export const ActivateFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const activateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ActivateFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(activateFlowDefinitionQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+/**
+ * Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
+Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
+Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+
+ * @summary Deactivate a flow definition by ID.
+ */
+export const DeactivateFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const deactivateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeactivateFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(deactivateFlowDefinitionQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
 /**
  * @summary Create team
  */