@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/generated/model/{getKeys4xx.ts → getEvent401.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetKeys4xxDetails } from "./getKeys4xxDetails";
+import type { GetEvent401Details } from "./getEvent401Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type GetKeys4xx = {
+export type GetEvent401 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetKeys4xxDetails;
+  details?: GetEvent401Details;
 };

package/src/generated/model/{getKeys4xxDetails.ts → getEvent401Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type GetKeys4xxDetails = { [key: string]: unknown };
+export type GetEvent401Details = { [key: string]: unknown };

package/src/generated/model/{getToken4xx.ts → getEvent403.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetToken4xxDetails } from "./getToken4xxDetails";
+import type { GetEvent403Details } from "./getEvent403Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type GetToken4xx = {
+export type GetEvent403 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetToken4xxDetails;
+  details?: GetEvent403Details;
 };

package/src/generated/model/{getToken4xxDetails.ts → getEvent403Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type GetToken4xxDetails = { [key: string]: unknown };
+export type GetEvent403Details = { [key: string]: unknown };

package/src/generated/model/getEvent404.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetEvent404Details } from "./getEvent404Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetEvent404 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetEvent404Details;
+};

package/src/generated/model/getEvent404Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetEvent404Details = { [key: string]: unknown };

package/src/generated/model/{getTokenDefault.ts → getEventDefault.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetTokenDefaultDetails } from "./getTokenDefaultDetails";
+import type { GetEventDefaultDetails } from "./getEventDefaultDetails";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type GetTokenDefault = {
+export type GetEventDefault = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetTokenDefaultDetails;
+  details?: GetEventDefaultDetails;
 };

package/src/generated/model/{getMySession401Details.ts → getEventDefaultDetails.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type GetMySession401Details = { [key: string]: unknown };
+export type GetEventDefaultDetails = { [key: string]: unknown };

package/src/generated/model/{getTeamParams.ts → getEventParams.ts}

@@ -6,7 +6,7 @@
  * OpenAPI spec version: 0.0.1
  */
 
-export type GetTeamParams = {
+export type GetEventParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$

package/src/generated/model/getFlowDefinition200FlowDefinitionStepsItemTransitions.ts

@@ -31,5 +31,16 @@ export type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
    */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+  flow's current purpose to this value — the dispatch mode a step's
+  challenges run under — while the flow's original purpose stays
+  pinned. Must be a purpose this definition serves, and `target`
+  must be that purpose's entry step. Mutually exclusive with
+  `action`: a transition either re-purposes within this flow or
+  targets another flow, never both.
+  Example: a "Sign up" navigation on the login identifier step
+  (`{ target: register, purpose: register }`).
+   */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };

package/src/generated/model/getFlowDefinitionDefault.ts

@@ -5,16 +5,75 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetFlowDefinitionDefaultDetails } from "./getFlowDefinitionDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type GetFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: GetFlowDefinitionDefaultDetails;
-};
+export type GetFlowDefinitionDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.permission_denied";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.missing_id";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.missing_project_id";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    });

package/src/generated/model/getFlowStep200.ts

@@ -24,9 +24,14 @@ export type GetFlowStep200 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: GetFlowStep200Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+
+  - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: GetFlowStep200Branding;
   /** Present when `step.complete` is `redirect`. */

package/src/generated/model/getFlowStep200Branding.ts

@@ -8,25 +8,41 @@
 import type { GetFlowStep200BrandingLayout } from "./getFlowStep200BrandingLayout";
 
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 export type GetFlowStep200Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: GetFlowStep200BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+
+     * @maxLength 131072
+     */
   liquid_template?: string;
   /** Team logo URL. */
   logo_url?: string;
-  /** Custom font URL (e.g., Google Fonts CSS). */
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string;
   /** Hero/background image URL (used by split layout). */
   hero_url?: string;

package/src/generated/model/getFlowStep200BrandingLayout.ts

@@ -9,7 +9,8 @@
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 export type GetFlowStep200BrandingLayout =

package/src/generated/model/getFlowStepDefault.ts

@@ -5,16 +5,115 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetFlowStepDefaultDetails } from "./getFlowStepDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type GetFlowStepDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: GetFlowStepDefaultDetails;
-};
+export type GetFlowStepDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.decrypt_failed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.completed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_expired";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.integrity";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "tkn.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.unknown_alg";
+    });

package/src/generated/model/getMySession200.ts

@@ -21,17 +21,16 @@ in through `auth_attempts`.
  */
 export type GetMySession200 = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: GetMySession200State;
   /** The authenticated user. Null for anonymous sessions and until the `user`

package/src/generated/model/getMySession200State.ts

@@ -8,10 +8,9 @@
 
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 export type GetMySession200State = (typeof GetMySession200State)[keyof typeof GetMySession200State];
@@ -20,5 +19,4 @@ export const GetMySession200State = {
   building: "building",
   active: "active",
   expired: "expired",
-  revoked: "revoked",
 } as const;

package/src/generated/model/getMySession401.ts

@@ -5,10 +5,12 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetMySession401Details } from "./getMySession401Details";
 
 /**
- * Standard error payload returned for failed API requests.
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
  */
 export type GetMySession401 = {
   /** Stable machine-readable error code. */
@@ -16,5 +18,7 @@ export type GetMySession401 = {
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetMySession401Details;
+  details?: { [key: string]: unknown };
+} & {
+  code: "auth.unauthorized";
 };

package/src/generated/model/getMySession404.ts

@@ -5,10 +5,12 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetMySession404Details } from "./getMySession404Details";
 
 /**
- * Standard error payload returned for failed API requests.
+ * The session was not found
+
+Error code: sess.not_found
+
  */
 export type GetMySession404 = {
   /** Stable machine-readable error code. */
@@ -16,5 +18,7 @@ export type GetMySession404 = {
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetMySession404Details;
+  details?: { [key: string]: unknown };
+} & {
+  code: "sess.not_found";
 };

package/src/generated/model/getMySessionDefault.ts

@@ -15,7 +15,7 @@ export type GetMySessionDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "sess.not_found";
+      code: "auth.unauthorized";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -26,4 +26,24 @@ export type GetMySessionDefault =
       details?: { [key: string]: unknown };
     } & {
       code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.not_found";
     });

package/src/generated/model/getMyUser200.ts

@@ -5,5 +5,34 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+import type { GetMyUser200Attributes } from "./getMyUser200Attributes";
+import type { GetMyUser200Metadata } from "./getMyUser200Metadata";
 
-export type GetMyUser200 = { [key: string]: unknown };
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity.
+
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
+
+ */
+export type GetMyUser200 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetMyUser200Attributes;
+  metadata: GetMyUser200Metadata;
+};

package/src/generated/model/getMyUser200Attributes.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+export type GetMyUser200Attributes = { [key: string]: unknown };

package/src/generated/model/getMyUser200Metadata.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetMyUser200MetadataStatus } from "./getMyUser200MetadataStatus";
+
+export type GetMyUser200Metadata = {
+  /** The time when the user was created. */
+  created_at: string;
+  /** The time when the user was last updated. */
+  updated_at: string;
+  /** The status of the user. */
+  status: GetMyUser200MetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+};

package/src/generated/model/getMyUser200MetadataStatus.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The status of the user.
+ */
+export type GetMyUser200MetadataStatus =
+  (typeof GetMyUser200MetadataStatus)[keyof typeof GetMyUser200MetadataStatus];
+
+export const GetMyUser200MetadataStatus = {
+  active: "active",
+  suspended: "suspended",
+  deactivated: "deactivated",
+  pending_purge: "pending_purge",
+} as const;