@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/generated/endpoints/zitadelNextGen.ts

@@ -8,13 +8,13 @@
 import { getProxyPath } from "../../runtime/base-url";
 import { customFetch } from "../../runtime/fetch";
 import type {
-  ActivateFlowDefinitionParams,
-  AuthorizeDevice200,
-  AuthorizeDeviceParams,
-  AuthorizeGetDefault,
-  AuthorizeGetParams,
+  CompleteClaim200,
+  CompleteClaimBody,
   CreateAuthAttempt201,
   CreateAuthAttemptBody,
+  CreateBranding201,
+  CreateBrandingBody,
+  CreateBrandingParams,
   CreateFlow201,
   CreateFlowBody,
   CreateFlowDefinition201,
@@ -33,294 +33,67 @@ import type {
   CreateUser201,
   CreateUserBody,
   CreateUserParams,
-  DeactivateFlowDefinitionParams,
-  DeleteFlowDefinitionParams,
-  EndSessionParams,
   ExchangeHandoff200,
   ExchangeHandoffBody,
   ExchangeHandoffParams,
   GetAuthAttempt200,
+  GetBrandingById200,
+  GetClaimStatus200,
+  GetClaimStatusParams,
+  GetEvent200,
+  GetEventParams,
   GetFlowDefinition200,
-  GetFlowDefinitionParams,
   GetFlowStep200,
   GetHealthDefault,
-  GetKeys200,
   GetLiveDefault,
   GetMySession200,
   GetMyUser200,
-  GetOpenIDConfiguration200,
   GetProject200,
   GetReadyDefault,
   GetSchemaById200,
   GetSchemaByIdParams,
   GetSession200,
-  GetSessionParams,
   GetTeam200,
-  GetTeamParams,
-  GetToken200,
-  GetTokenBody,
   GetUserByID200,
   GetUserByIDParams,
-  GetUserInfo200,
-  Introspect200,
-  IntrospectBody,
+  InitClaim201,
   IssueChallenge201,
   IssueChallengeBody,
+  ListBranding200Item,
+  ListBrandingParams,
+  ListEvents200,
+  ListEventsParams,
   ListFlowDefinitions200,
   ListFlowDefinitionsParams,
   ListSchemas200Item,
   ListSchemasParams,
-  ListSessions200,
-  ListSessionsParams,
-  ListUsers200Item,
+  ListUserPasskeys200,
+  ListUserPasskeysParams,
+  ListUserTeams200,
+  ListUserTeamsParams,
+  ListUsers200,
   ListUsersParams,
   PatchProject200,
   PatchProjectBody,
   QueryProjects200,
   QueryProjectsBody,
-  RevokeSessionParams,
-  RevokeTokenBody,
+  QuerySessions200,
+  QuerySessionsBody,
+  QuerySessionsParams,
+  QueryTeams200,
+  QueryTeamsBody,
+  QueryTeamsParams,
   SetUserPasswordBody,
-  SetUserPasswordParams,
-  SubmitFlowEventBody,
   SubmitFlowStep200,
   SubmitFlowStepBody,
   UpdateFlowDefinition200,
   UpdateFlowDefinitionBody,
-  UpdateFlowDefinitionParams,
+  UpdateTeam200,
+  UpdateTeamBody,
   VerifyChallengeProof200,
   VerifyChallengeProofBody,
 } from "../model";
 
-export const getGetOpenIDConfigurationUrl = () => {
-  return `${getProxyPath()}/.well-known/openid-configuration`;
-};
-
-/**
- * Retrieve the OpenID Connect configuration
- * @summary Get OpenID Connect configuration
- */
-export const getOpenIDConfiguration = async (
-  options?: RequestInit,
-): Promise<GetOpenIDConfiguration200> => {
-  return customFetch<GetOpenIDConfiguration200>(getGetOpenIDConfigurationUrl(), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getAuthorizeGetUrl = (params: AuthorizeGetParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/authorize?${stringifiedParams}`
-    : `${getProxyPath()}/auth/authorize`;
-};
-
-/**
- * @summary Authorize a user
- */
-export const authorizeGet = async (
-  params: AuthorizeGetParams,
-  options?: RequestInit,
-): Promise<AuthorizeGetDefault> => {
-  return customFetch<AuthorizeGetDefault>(getAuthorizeGetUrl(params), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getAuthorizeDeviceUrl = (params: AuthorizeDeviceParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}`
-    : `${getProxyPath()}/auth/device-authorization`;
-};
-
-/**
- * @summary Authorize a device
- */
-export const authorizeDevice = async (
-  params: AuthorizeDeviceParams,
-  options?: RequestInit,
-): Promise<AuthorizeDevice200> => {
-  return customFetch<AuthorizeDevice200>(getAuthorizeDeviceUrl(params), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getEndSessionUrl = (params?: EndSessionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/end-session?${stringifiedParams}`
-    : `${getProxyPath()}/auth/end-session`;
-};
-
-/**
- * @summary End a session
- */
-export const endSession = async (
-  params?: EndSessionParams,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getEndSessionUrl(params), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getIntrospectUrl = () => {
-  return `${getProxyPath()}/auth/introspect`;
-};
-
-/**
- * @summary Introspect a token
- */
-export const introspect = async (
-  introspectBody: IntrospectBody,
-  options?: RequestInit,
-): Promise<Introspect200> => {
-  const formUrlEncoded = new URLSearchParams();
-  formUrlEncoded.append(`token`, introspectBody.token);
-  if (introspectBody.token_type_hint !== undefined) {
-    formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-  }
-
-  return customFetch<Introspect200>(getIntrospectUrl(), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
-  });
-};
-
-export const getGetKeysUrl = () => {
-  return `${getProxyPath()}/auth/keys`;
-};
-
-/**
- * @summary Get public keys
- */
-export const getKeys = async (options?: RequestInit): Promise<GetKeys200> => {
-  return customFetch<GetKeys200>(getGetKeysUrl(), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getRevokeTokenUrl = () => {
-  return `${getProxyPath()}/auth/revoke`;
-};
-
-/**
- * @summary Revoke an access token or refresh token
- */
-export const revokeToken = async (
-  revokeTokenBody: RevokeTokenBody,
-  options?: RequestInit,
-): Promise<void> => {
-  const formUrlEncoded = new URLSearchParams();
-  if (revokeTokenBody.token !== undefined) {
-    formUrlEncoded.append(`token`, revokeTokenBody.token);
-  }
-  if (revokeTokenBody.token_type_hint !== undefined) {
-    formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-  }
-
-  return customFetch<void>(getRevokeTokenUrl(), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
-  });
-};
-
-export const getGetTokenUrl = () => {
-  return `${getProxyPath()}/auth/token`;
-};
-
-/**
- * @summary Get access token
- */
-export const getToken = async (
-  getTokenBody: GetTokenBody,
-  options?: RequestInit,
-): Promise<GetToken200> => {
-  const formUrlEncoded = new URLSearchParams();
-  if (getTokenBody.code !== undefined) {
-    formUrlEncoded.append(`code`, getTokenBody.code);
-  }
-  if (getTokenBody.client_assertion !== undefined) {
-    formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-  }
-  if (getTokenBody.client_assertion_type !== undefined) {
-    formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-  }
-  if (getTokenBody.client_id !== undefined) {
-    formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-  }
-  if (getTokenBody.client_secret !== undefined) {
-    formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-  }
-  if (getTokenBody.code_verifier !== undefined) {
-    formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-  }
-  if (getTokenBody.grant_type !== undefined) {
-    formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-  }
-  if (getTokenBody.redirect_uri !== undefined) {
-    formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-  }
-
-  return customFetch<GetToken200>(getGetTokenUrl(), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
-  });
-};
-
-export const getGetUserInfoUrl = () => {
-  return `${getProxyPath()}/auth/userinfo`;
-};
-
-/**
- * @summary Get user info
- */
-export const getUserInfo = async (options?: RequestInit): Promise<GetUserInfo200> => {
-  return customFetch<GetUserInfo200>(getGetUserInfoUrl(), {
-    ...options,
-    method: "GET",
-  });
-};
-
 export const getGetHealthUrl = () => {
   return `${getProxyPath()}/healthz`;
 };
@@ -420,14 +193,14 @@ export const getListUsersUrl = (params?: ListUsersParams) => {
 export const listUsers = async (
   params?: ListUsersParams,
   options?: RequestInit,
-): Promise<ListUsers200Item[]> => {
-  return customFetch<ListUsers200Item[]>(getListUsersUrl(params), {
+): Promise<ListUsers200> => {
+  return customFetch<ListUsers200>(getListUsersUrl(params), {
     ...options,
     method: "GET",
   });
 };
 
-export const getGetUserByIDUrl = (userId: string, params: GetUserByIDParams) => {
+export const getGetUserByIDUrl = (userId: string, params?: GetUserByIDParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -448,7 +221,7 @@ export const getGetUserByIDUrl = (userId: string, params: GetUserByIDParams) =>
  */
 export const getUserByID = async (
   userId: string,
-  params: GetUserByIDParams,
+  params?: GetUserByIDParams,
   options?: RequestInit,
 ): Promise<GetUserByID200> => {
   return customFetch<GetUserByID200>(getGetUserByIDUrl(userId, params), {
@@ -457,7 +230,21 @@ export const getUserByID = async (
   });
 };
 
-export const getSetUserPasswordUrl = (userId: string, params: SetUserPasswordParams) => {
+export const getDeleteUserByIDUrl = (userId: string) => {
+  return `${getProxyPath()}/users/${userId}`;
+};
+
+/**
+ * @summary Delete user by ID
+ */
+export const deleteUserByID = async (userId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteUserByIDUrl(userId), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getListUserPasskeysUrl = (userId: string, params?: ListUserPasskeysParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -469,8 +256,26 @@ export const getSetUserPasswordUrl = (userId: string, params: SetUserPasswordPar
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}`
-    : `${getProxyPath()}/users/${userId}/password`;
+    ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}`
+    : `${getProxyPath()}/users/${userId}/passkeys`;
+};
+
+/**
+ * @summary List user passkeys
+ */
+export const listUserPasskeys = async (
+  userId: string,
+  params?: ListUserPasskeysParams,
+  options?: RequestInit,
+): Promise<ListUserPasskeys200> => {
+  return customFetch<ListUserPasskeys200>(getListUserPasskeysUrl(userId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getSetUserPasswordUrl = (userId: string) => {
+  return `${getProxyPath()}/users/${userId}/password`;
 };
 
 /**
@@ -479,10 +284,9 @@ export const getSetUserPasswordUrl = (userId: string, params: SetUserPasswordPar
 export const setUserPassword = async (
   userId: string,
   setUserPasswordBody: SetUserPasswordBody,
-  params: SetUserPasswordParams,
   options?: RequestInit,
 ): Promise<void> => {
-  return customFetch<void>(getSetUserPasswordUrl(userId, params), {
+  return customFetch<void>(getSetUserPasswordUrl(userId), {
     ...options,
     method: "PUT",
     headers: { "Content-Type": "application/json", ...options?.headers },
@@ -490,6 +294,44 @@ export const setUserPassword = async (
   });
 };
 
+export const getListUserTeamsUrl = (userId: string, params?: ListUserTeamsParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}`
+    : `${getProxyPath()}/users/${userId}/teams`;
+};
+
+/**
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
+ */
+export const listUserTeams = async (
+  userId: string,
+  params?: ListUserTeamsParams,
+  options?: RequestInit,
+): Promise<ListUserTeams200> => {
+  return customFetch<ListUserTeams200>(getListUserTeamsUrl(userId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
 export const getGetMyUserUrl = () => {
   return `${getProxyPath()}/users/me`;
 };
@@ -514,7 +356,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -600,29 +442,6 @@ export const submitFlowStep = async (
   });
 };
 
-export const getSubmitFlowEventUrl = (id: string) => {
-  return `${getProxyPath()}/flow/${id}/event`;
-};
-
-/**
- * Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
- * @summary Submit client-side event
- */
-export const submitFlowEvent = async (
-  id: string,
-  submitFlowEventBody: SubmitFlowEventBody,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getSubmitFlowEventUrl(id), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(submitFlowEventBody),
-  });
-};
-
 export const getCreateAuthAttemptUrl = () => {
   return `${getProxyPath()}/auth_attempts`;
 };
@@ -841,6 +660,89 @@ export const patchProject = async (
   });
 };
 
+export const getInitClaimUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
+
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+export const initClaim = async (
+  projectId: string,
+  options?: RequestInit,
+): Promise<InitClaim201> => {
+  return customFetch<InitClaim201>(getInitClaimUrl(projectId), {
+    ...options,
+    method: "POST",
+  });
+};
+
+export const getGetClaimStatusUrl = (projectId: string, params: GetClaimStatusParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}`
+    : `${getProxyPath()}/projects/${projectId}/claim/status`;
+};
+
+/**
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+ * @summary Get claim status
+ */
+export const getClaimStatus = async (
+  projectId: string,
+  params: GetClaimStatusParams,
+  options?: RequestInit,
+): Promise<GetClaimStatus200> => {
+  return customFetch<GetClaimStatus200>(getGetClaimStatusUrl(projectId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCompleteClaimUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+export const completeClaim = async (
+  projectId: string,
+  completeClaimBody: CompleteClaimBody,
+  options?: RequestInit,
+): Promise<CompleteClaim200> => {
+  return customFetch<CompleteClaim200>(getCompleteClaimUrl(projectId), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(completeClaimBody),
+  });
+};
+
 export const getCreateSessionUrl = () => {
   return `${getProxyPath()}/sessions`;
 };
@@ -854,8 +756,16 @@ Use this explicitly when you want to:
   can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -874,7 +784,7 @@ export const createSession = async (
   });
 };
 
-export const getListSessionsUrl = (params: ListSessionsParams) => {
+export const getQuerySessionsUrl = (params: QuerySessionsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -886,23 +796,27 @@ export const getListSessionsUrl = (params: ListSessionsParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions?${stringifiedParams}`
-    : `${getProxyPath()}/sessions`;
+    ? `${getProxyPath()}/sessions/query?${stringifiedParams}`
+    : `${getProxyPath()}/sessions/query`;
 };
 
 /**
- * Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
- * @summary List sessions
+ * @summary Query sessions
  */
-export const listSessions = async (
-  params: ListSessionsParams,
+export const querySessions = async (
+  querySessionsBody: QuerySessionsBody,
+  params: QuerySessionsParams,
   options?: RequestInit,
-): Promise<ListSessions200> => {
-  return customFetch<ListSessions200>(getListSessionsUrl(params), {
+): Promise<QuerySessions200> => {
+  return customFetch<QuerySessions200>(getQuerySessionsUrl(params), {
     ...options,
-    method: "GET",
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(querySessionsBody),
   });
 };
 
@@ -956,20 +870,8 @@ export const exchangeHandoff = async (
   });
 };
 
-export const getGetSessionUrl = (sessionId: string, params: GetSessionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
-    : `${getProxyPath()}/sessions/${sessionId}`;
+export const getGetSessionUrl = (sessionId: string) => {
+  return `${getProxyPath()}/sessions/${sessionId}`;
 };
 
 /**
@@ -984,45 +886,33 @@ against the same `session_id`) to restore a dropped assurance level.
  */
 export const getSession = async (
   sessionId: string,
-  params: GetSessionParams,
   options?: RequestInit,
 ): Promise<GetSession200> => {
-  return customFetch<GetSession200>(getGetSessionUrl(sessionId, params), {
+  return customFetch<GetSession200>(getGetSessionUrl(sessionId), {
     ...options,
     method: "GET",
   });
 };
 
-export const getRevokeSessionUrl = (sessionId: string, params: RevokeSessionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
-    : `${getProxyPath()}/sessions/${sessionId}`;
+export const getRevokeSessionUrl = (sessionId: string) => {
+  return `${getProxyPath()}/sessions/${sessionId}`;
 };
 
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
  * @summary Revoke session
  */
-export const revokeSession = async (
-  sessionId: string,
-  params: RevokeSessionParams,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getRevokeSessionUrl(sessionId, params), {
+export const revokeSession = async (sessionId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getRevokeSessionUrl(sessionId), {
     ...options,
     method: "DELETE",
   });
@@ -1054,10 +944,12 @@ export const getRevokeMySessionUrl = () => {
 };
 
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
  * @summary Revoke my session
  */
@@ -1085,10 +977,12 @@ export const getCreateSchemaUrl = (params: CreateSchemaParams) => {
 };
 
 /**
- * Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1140,7 +1034,7 @@ export const listSchemas = async (
   });
 };
 
-export const getGetSchemaByIdUrl = (id: string, params: GetSchemaByIdParams) => {
+export const getGetSchemaByIdUrl = (id: string, params?: GetSchemaByIdParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1162,7 +1056,7 @@ export const getGetSchemaByIdUrl = (id: string, params: GetSchemaByIdParams) =>
  */
 export const getSchemaById = async (
   id: string,
-  params: GetSchemaByIdParams,
+  params?: GetSchemaByIdParams,
   options?: RequestInit,
 ): Promise<GetSchemaById200> => {
   return customFetch<GetSchemaById200>(getGetSchemaByIdUrl(id, params), {
@@ -1228,20 +1122,8 @@ export const listFlowDefinitions = async (
   });
 };
 
-export const getGetFlowDefinitionUrl = (id: string, params: GetFlowDefinitionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+export const getGetFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
 };
 
 /**
@@ -1250,16 +1132,56 @@ export const getGetFlowDefinitionUrl = (id: string, params: GetFlowDefinitionPar
  */
 export const getFlowDefinition = async (
   id: string,
-  params: GetFlowDefinitionParams,
   options?: RequestInit,
 ): Promise<GetFlowDefinition200> => {
-  return customFetch<GetFlowDefinition200>(getGetFlowDefinitionUrl(id, params), {
+  return customFetch<GetFlowDefinition200>(getGetFlowDefinitionUrl(id), {
     ...options,
     method: "GET",
   });
 };
 
-export const getUpdateFlowDefinitionUrl = (id: string, params: UpdateFlowDefinitionParams) => {
+export const getUpdateFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+ * @summary Update a flow definition by id
+ */
+export const updateFlowDefinition = async (
+  id: string,
+  updateFlowDefinitionBody: UpdateFlowDefinitionBody,
+  options?: RequestInit,
+): Promise<UpdateFlowDefinition200> => {
+  return customFetch<UpdateFlowDefinition200>(getUpdateFlowDefinitionUrl(id), {
+    ...options,
+    method: "PUT",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(updateFlowDefinitionBody),
+  });
+};
+
+export const getDeleteFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+ * @summary Delete a flow definition by id
+ */
+export const deleteFlowDefinition = async (id: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteFlowDefinitionUrl(id), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getCreateTeamUrl = (params: CreateTeamParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1271,31 +1193,27 @@ export const getUpdateFlowDefinitionUrl = (id: string, params: UpdateFlowDefinit
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+    ? `${getProxyPath()}/teams?${stringifiedParams}`
+    : `${getProxyPath()}/teams`;
 };
 
 /**
- * Update a flow definition by id. This endpoint replaces the existing flow definition.
-If `flow_definition.status` is omitted, the current status is preserved
-
- * @summary Update a flow definition by id
+ * @summary Create team
  */
-export const updateFlowDefinition = async (
-  id: string,
-  updateFlowDefinitionBody: UpdateFlowDefinitionBody,
-  params: UpdateFlowDefinitionParams,
+export const createTeam = async (
+  createTeamBody: CreateTeamBody,
+  params: CreateTeamParams,
   options?: RequestInit,
-): Promise<UpdateFlowDefinition200> => {
-  return customFetch<UpdateFlowDefinition200>(getUpdateFlowDefinitionUrl(id, params), {
+): Promise<CreateTeam201> => {
+  return customFetch<CreateTeam201>(getCreateTeamUrl(params), {
     ...options,
-    method: "PUT",
+    method: "POST",
     headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(updateFlowDefinitionBody),
+    body: JSON.stringify(createTeamBody),
   });
 };
 
-export const getDeleteFlowDefinitionUrl = (id: string, params: DeleteFlowDefinitionParams) => {
+export const getQueryTeamsUrl = (params: QueryTeamsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1307,29 +1225,90 @@ export const getDeleteFlowDefinitionUrl = (id: string, params: DeleteFlowDefinit
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+    ? `${getProxyPath()}/teams/query?${stringifiedParams}`
+    : `${getProxyPath()}/teams/query`;
 };
 
 /**
- * Delete a flow definition by id.
-If the flow definition is currently being used by a flow, the deletion will fail.
-If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+ * Returns the teams of a project, paginated with a cursor.
 
- * @summary Delete a flow definition by id
+ * @summary Query teams
  */
-export const deleteFlowDefinition = async (
-  id: string,
-  params: DeleteFlowDefinitionParams,
+export const queryTeams = async (
+  queryTeamsBody: QueryTeamsBody,
+  params: QueryTeamsParams,
   options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getDeleteFlowDefinitionUrl(id, params), {
+): Promise<QueryTeams200> => {
+  return customFetch<QueryTeams200>(getQueryTeamsUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(queryTeamsBody),
+  });
+};
+
+export const getGetTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Returns a Team by its id.
+
+ * @summary Get team
+ */
+export const getTeam = async (teamId: string, options?: RequestInit): Promise<GetTeam200> => {
+  return customFetch<GetTeam200>(getGetTeamUrl(teamId), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getDeleteTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
+ */
+export const deleteTeam = async (teamId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteTeamUrl(teamId), {
     ...options,
     method: "DELETE",
   });
 };
 
-export const getActivateFlowDefinitionUrl = (id: string, params: ActivateFlowDefinitionParams) => {
+export const getUpdateTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Update team. Only active teams can be updated.
+
+ * @summary Update team
+ */
+export const updateTeam = async (
+  teamId: string,
+  updateTeamBody: UpdateTeamBody,
+  options?: RequestInit,
+): Promise<UpdateTeam200> => {
+  return customFetch<UpdateTeam200>(getUpdateTeamUrl(teamId), {
+    ...options,
+    method: "PATCH",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(updateTeamBody),
+  });
+};
+
+export const getCreateBrandingUrl = (params: CreateBrandingParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1341,31 +1320,37 @@ export const getActivateFlowDefinitionUrl = (id: string, params: ActivateFlowDef
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}/activate?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}/activate`;
+    ? `${getProxyPath()}/branding?${stringifiedParams}`
+    : `${getProxyPath()}/branding`;
 };
 
 /**
- * Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
 
- * @summary Activate a flow definition by ID.
+ * @summary Publish a new branding revision
  */
-export const activateFlowDefinition = async (
-  id: string,
-  params: ActivateFlowDefinitionParams,
+export const createBranding = async (
+  createBrandingBody: CreateBrandingBody,
+  params: CreateBrandingParams,
   options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getActivateFlowDefinitionUrl(id, params), {
+): Promise<CreateBranding201> => {
+  return customFetch<CreateBranding201>(getCreateBrandingUrl(params), {
     ...options,
     method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createBrandingBody),
   });
 };
 
-export const getDeactivateFlowDefinitionUrl = (
-  id: string,
-  params: DeactivateFlowDefinitionParams,
-) => {
+export const getListBrandingUrl = (params: ListBrandingParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1377,32 +1362,60 @@ export const getDeactivateFlowDefinitionUrl = (
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}/deactivate?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}/deactivate`;
+    ? `${getProxyPath()}/branding?${stringifiedParams}`
+    : `${getProxyPath()}/branding`;
 };
 
 /**
- * Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
 
- * @summary Deactivate a flow definition by ID.
+ * @summary List branding revisions
+ */
+export const listBranding = async (
+  params: ListBrandingParams,
+  options?: RequestInit,
+): Promise<ListBranding200Item[]> => {
+  return customFetch<ListBranding200Item[]>(getListBrandingUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetBrandingByIdUrl = (id: string) => {
+  return `${getProxyPath()}/branding/${id}`;
+};
+
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
  */
-export const deactivateFlowDefinition = async (
+export const getBrandingById = async (
   id: string,
-  params: DeactivateFlowDefinitionParams,
   options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getDeactivateFlowDefinitionUrl(id, params), {
+): Promise<GetBrandingById200> => {
+  return customFetch<GetBrandingById200>(getGetBrandingByIdUrl(id), {
     ...options,
-    method: "POST",
+    method: "GET",
   });
 };
 
-export const getCreateTeamUrl = (params: CreateTeamParams) => {
+export const getListEventsUrl = (params: ListEventsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
+    const explodeParameters = ["category", "event_type"];
+
+    if (Array.isArray(value) && explodeParameters.includes(key)) {
+      value.forEach((v) => {
+        normalizedParams.append(key, v === null ? "null" : v.toString());
+      });
+      return;
+    }
+
     if (value !== undefined) {
       normalizedParams.append(key, value === null ? "null" : value.toString());
     }
@@ -1411,27 +1424,36 @@ export const getCreateTeamUrl = (params: CreateTeamParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/teams?${stringifiedParams}`
-    : `${getProxyPath()}/teams`;
+    ? `${getProxyPath()}/events?${stringifiedParams}`
+    : `${getProxyPath()}/events`;
 };
 
 /**
- * @summary Create team
+ * Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+ * @summary List events
  */
-export const createTeam = async (
-  params: CreateTeamParams,
-  createTeamBody?: CreateTeamBody,
+export const listEvents = async (
+  params: ListEventsParams,
   options?: RequestInit,
-): Promise<CreateTeam201> => {
-  return customFetch<CreateTeam201>(getCreateTeamUrl(params), {
+): Promise<ListEvents200> => {
+  return customFetch<ListEvents200>(getListEventsUrl(params), {
     ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(createTeamBody),
+    method: "GET",
   });
 };
 
-export const getGetTeamUrl = (teamId: string, params: GetTeamParams) => {
+export const getGetEventUrl = (id: string, params: GetEventParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1443,21 +1465,25 @@ export const getGetTeamUrl = (teamId: string, params: GetTeamParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}`
-    : `${getProxyPath()}/teams/${teamId}`;
+    ? `${getProxyPath()}/events/${id}?${stringifiedParams}`
+    : `${getProxyPath()}/events/${id}`;
 };
 
 /**
- * Returns the current state of a team.
+ * Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
 
- * @summary Get team
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+ * @summary Get event by ID
  */
-export const getTeam = async (
-  teamId: string,
-  params: GetTeamParams,
+export const getEvent = async (
+  id: string,
+  params: GetEventParams,
   options?: RequestInit,
-): Promise<GetTeam200> => {
-  return customFetch<GetTeam200>(getGetTeamUrl(teamId, params), {
+): Promise<GetEvent200> => {
+  return customFetch<GetEvent200>(getGetEventUrl(id, params), {
     ...options,
     method: "GET",
   });