@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/endpoints/zitadelNextGen.ts

@@ -8,19 +8,29 @@
 import { getProxyPath } from "../../runtime/base-url";
 import { customFetch } from "../../runtime/fetch";
 import type {
-  AuthorizeDevice200,
-  AuthorizeDeviceParams,
-  AuthorizeGetDefault,
-  AuthorizeGetParams,
+  BeginUserPasskeyRegistration201,
+  BeginUserPasskeyRegistrationBody,
+  CompleteClaim200,
+  CompleteClaimBody,
   CreateAuthAttempt201,
   CreateAuthAttemptBody,
+  CreateBranding201,
+  CreateBrandingBody,
+  CreateBrandingParams,
   CreateFlow201,
   CreateFlowBody,
   CreateFlowDefinition201,
   CreateFlowDefinitionBody,
+  CreateGrant201,
+  CreateGrantBody,
+  CreateGrantParams,
   CreateHandoff200,
   CreateProject201,
   CreateProjectBody,
+  CreateRelease200,
+  CreateRelease201,
+  CreateReleaseBody,
+  CreateReleaseParams,
   CreateSchema201,
   CreateSchemaBody,
   CreateSchemaParams,
@@ -32,134 +42,126 @@ import type {
   CreateUser201,
   CreateUserBody,
   CreateUserParams,
-  DeleteFlowDefinitionParams,
-  EndSessionParams,
+  DeleteGrantParams,
   ExchangeHandoff200,
   ExchangeHandoffBody,
   ExchangeHandoffParams,
+  FinishUserPasskeyRegistration201,
+  FinishUserPasskeyRegistrationBody,
   GetAuthAttempt200,
+  GetBrandingById200,
+  GetClaimStatus200,
+  GetClaimStatusParams,
+  GetEnvironmentByName200,
+  GetEnvironmentByNameParams,
+  GetEvent200,
+  GetEventParams,
   GetFlowDefinition200,
-  GetFlowDefinitionParams,
   GetFlowStep200,
+  GetGrant200,
+  GetGrantParams,
   GetHealthDefault,
-  GetKeys200,
   GetLiveDefault,
   GetMySession200,
   GetMyUser200,
-  GetOpenIDConfiguration200,
   GetProject200,
   GetReadyDefault,
+  GetReleaseById200,
+  GetReleaseByIdParams,
   GetSchemaById200,
   GetSchemaByIdParams,
   GetSession200,
-  GetSessionParams,
   GetTeam200,
-  GetTeamParams,
-  GetToken200,
-  GetTokenBody,
   GetUserByID200,
   GetUserByIDParams,
-  GetUserInfo200,
-  Introspect200,
-  IntrospectBody,
+  InitClaim201,
   IssueChallenge201,
   IssueChallengeBody,
+  ListBranding200Item,
+  ListBrandingParams,
+  ListEnvironments200,
+  ListEnvironmentsParams,
+  ListEvents200,
+  ListEventsParams,
   ListFlowDefinitions200,
   ListFlowDefinitionsParams,
-  ListSessions200,
-  ListSessionsParams,
-  ListUsers200Item,
-  ListUsersParams,
-  RevokeSessionParams,
-  RevokeTokenBody,
+  ListReleases200,
+  ListReleasesParams,
+  ListSchemas200,
+  ListSchemasParams,
+  ListUserPasskeys200,
+  ListUserPasskeysParams,
+  ListUserTeams200,
+  ListUserTeamsParams,
+  PatchProject200,
+  PatchProjectBody,
+  QueryProjects200,
+  QueryProjectsBody,
+  QuerySessions200,
+  QuerySessionsBody,
+  QuerySessionsParams,
+  QueryTeams200,
+  QueryTeamsBody,
+  QueryTeamsParams,
+  QueryUsers200,
+  QueryUsersBody,
   SetUserPasswordBody,
-  SetUserPasswordParams,
-  SubmitFlowEventBody,
   SubmitFlowStep200,
   SubmitFlowStepBody,
   UpdateFlowDefinition200,
   UpdateFlowDefinitionBody,
-  UpdateFlowDefinitionParams,
+  UpdateTeam200,
+  UpdateTeamBody,
   VerifyChallengeProof200,
   VerifyChallengeProofBody,
 } from "../model";
 
-export const getGetOpenIDConfigurationUrl = () => {
-  return `${getProxyPath()}/.well-known/openid-configuration`;
+export const getGetHealthUrl = () => {
+  return `${getProxyPath()}/healthz`;
 };
 
 /**
- * Retrieve the OpenID Connect configuration
- * @summary Get OpenID Connect configuration
+ * Check whether the server is healthy
+ * @summary Check server health
  */
-export const getOpenIDConfiguration = async (
-  options?: RequestInit,
-): Promise<GetOpenIDConfiguration200> => {
-  return customFetch<GetOpenIDConfiguration200>(getGetOpenIDConfigurationUrl(), {
+export const getHealth = async (options?: RequestInit): Promise<GetHealthDefault> => {
+  return customFetch<GetHealthDefault>(getGetHealthUrl(), {
     ...options,
     method: "GET",
   });
 };
 
-export const getAuthorizeGetUrl = (params: AuthorizeGetParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/authorize?${stringifiedParams}`
-    : `${getProxyPath()}/auth/authorize`;
+export const getGetLiveUrl = () => {
+  return `${getProxyPath()}/livez`;
 };
 
 /**
- * @summary Authorize a user
+ * Check whether the server is started
+ * @summary Check server liveness
  */
-export const authorizeGet = async (
-  params: AuthorizeGetParams,
-  options?: RequestInit,
-): Promise<AuthorizeGetDefault> => {
-  return customFetch<AuthorizeGetDefault>(getAuthorizeGetUrl(params), {
+export const getLive = async (options?: RequestInit): Promise<GetLiveDefault> => {
+  return customFetch<GetLiveDefault>(getGetLiveUrl(), {
     ...options,
     method: "GET",
   });
 };
 
-export const getAuthorizeDeviceUrl = (params: AuthorizeDeviceParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}`
-    : `${getProxyPath()}/auth/device-authorization`;
+export const getGetReadyUrl = () => {
+  return `${getProxyPath()}/readyz`;
 };
 
 /**
- * @summary Authorize a device
+ * Check whether the server is ready to accept requests
+ * @summary Check server readiness
  */
-export const authorizeDevice = async (
-  params: AuthorizeDeviceParams,
-  options?: RequestInit,
-): Promise<AuthorizeDevice200> => {
-  return customFetch<AuthorizeDevice200>(getAuthorizeDeviceUrl(params), {
+export const getReady = async (options?: RequestInit): Promise<GetReadyDefault> => {
+  return customFetch<GetReadyDefault>(getGetReadyUrl(), {
     ...options,
     method: "GET",
   });
 };
 
-export const getEndSessionUrl = (params?: EndSessionParams) => {
+export const getCreateUserUrl = (params: CreateUserParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -171,194 +173,96 @@ export const getEndSessionUrl = (params?: EndSessionParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/auth/end-session?${stringifiedParams}`
-    : `${getProxyPath()}/auth/end-session`;
-};
-
-/**
- * @summary End a session
- */
-export const endSession = async (
-  params?: EndSessionParams,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getEndSessionUrl(params), {
-    ...options,
-    method: "GET",
-  });
-};
-
-export const getIntrospectUrl = () => {
-  return `${getProxyPath()}/auth/introspect`;
+    ? `${getProxyPath()}/users?${stringifiedParams}`
+    : `${getProxyPath()}/users`;
 };
 
 /**
- * @summary Introspect a token
+ * @summary Create user
  */
-export const introspect = async (
-  introspectBody: IntrospectBody,
+export const createUser = async (
+  createUserBody: CreateUserBody,
+  params: CreateUserParams,
   options?: RequestInit,
-): Promise<Introspect200> => {
-  const formUrlEncoded = new URLSearchParams();
-  formUrlEncoded.append(`token`, introspectBody.token);
-  if (introspectBody.token_type_hint !== undefined) {
-    formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-  }
-
-  return customFetch<Introspect200>(getIntrospectUrl(), {
+): Promise<CreateUser201> => {
+  return customFetch<CreateUser201>(getCreateUserUrl(params), {
     ...options,
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
-  });
-};
-
-export const getGetKeysUrl = () => {
-  return `${getProxyPath()}/auth/keys`;
-};
-
-/**
- * @summary Get public keys
- */
-export const getKeys = async (options?: RequestInit): Promise<GetKeys200> => {
-  return customFetch<GetKeys200>(getGetKeysUrl(), {
-    ...options,
-    method: "GET",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createUserBody),
   });
 };
 
-export const getRevokeTokenUrl = () => {
-  return `${getProxyPath()}/auth/revoke`;
+export const getQueryUsersUrl = () => {
+  return `${getProxyPath()}/users/query`;
 };
 
 /**
- * @summary Revoke an access token or refresh token
- */
-export const revokeToken = async (
-  revokeTokenBody: RevokeTokenBody,
-  options?: RequestInit,
-): Promise<void> => {
-  const formUrlEncoded = new URLSearchParams();
-  if (revokeTokenBody.token !== undefined) {
-    formUrlEncoded.append(`token`, revokeTokenBody.token);
-  }
-  if (revokeTokenBody.token_type_hint !== undefined) {
-    formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-  }
-
-  return customFetch<void>(getRevokeTokenUrl(), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
-  });
-};
+ * Returns the users of a project, paginated with a cursor.
 
-export const getGetTokenUrl = () => {
-  return `${getProxyPath()}/auth/token`;
-};
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
 
-/**
- * @summary Get accesstoken
+ * @summary Query users
  */
-export const getToken = async (
-  getTokenBody: GetTokenBody,
+export const queryUsers = async (
+  queryUsersBody: QueryUsersBody,
   options?: RequestInit,
-): Promise<GetToken200> => {
-  const formUrlEncoded = new URLSearchParams();
-  if (getTokenBody.code !== undefined) {
-    formUrlEncoded.append(`code`, getTokenBody.code);
-  }
-  if (getTokenBody.client_assertion !== undefined) {
-    formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-  }
-  if (getTokenBody.client_assertion_type !== undefined) {
-    formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-  }
-  if (getTokenBody.client_id !== undefined) {
-    formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-  }
-  if (getTokenBody.client_secret !== undefined) {
-    formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-  }
-  if (getTokenBody.code_verifier !== undefined) {
-    formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-  }
-  if (getTokenBody.grant_type !== undefined) {
-    formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-  }
-  if (getTokenBody.redirect_uri !== undefined) {
-    formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-  }
-
-  return customFetch<GetToken200>(getGetTokenUrl(), {
+): Promise<QueryUsers200> => {
+  return customFetch<QueryUsers200>(getQueryUsersUrl(), {
     ...options,
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", ...options?.headers },
-    body: formUrlEncoded,
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(queryUsersBody),
   });
 };
 
-export const getGetUserInfoUrl = () => {
-  return `${getProxyPath()}/auth/userinfo`;
-};
+export const getGetUserByIDUrl = (userId: string, params?: GetUserByIDParams) => {
+  const normalizedParams = new URLSearchParams();
 
-/**
- * @summary Get user info
- */
-export const getUserInfo = async (options?: RequestInit): Promise<GetUserInfo200> => {
-  return customFetch<GetUserInfo200>(getGetUserInfoUrl(), {
-    ...options,
-    method: "GET",
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
   });
-};
-
-export const getGetHealthUrl = () => {
-  return `${getProxyPath()}/healthz`;
-};
 
-/**
- * Check whether the server is healthy
- * @summary Check server health
- */
-export const getHealth = async (options?: RequestInit): Promise<GetHealthDefault> => {
-  return customFetch<GetHealthDefault>(getGetHealthUrl(), {
-    ...options,
-    method: "GET",
-  });
-};
+  const stringifiedParams = normalizedParams.toString();
 
-export const getGetLiveUrl = () => {
-  return `${getProxyPath()}/livez`;
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/users/${userId}?${stringifiedParams}`
+    : `${getProxyPath()}/users/${userId}`;
 };
 
 /**
- * Check whether the server is started
- * @summary Check server liveness
+ * @summary Get user by ID
  */
-export const getLive = async (options?: RequestInit): Promise<GetLiveDefault> => {
-  return customFetch<GetLiveDefault>(getGetLiveUrl(), {
+export const getUserByID = async (
+  userId: string,
+  params?: GetUserByIDParams,
+  options?: RequestInit,
+): Promise<GetUserByID200> => {
+  return customFetch<GetUserByID200>(getGetUserByIDUrl(userId, params), {
     ...options,
     method: "GET",
   });
 };
 
-export const getGetReadyUrl = () => {
-  return `${getProxyPath()}/readyz`;
+export const getDeleteUserByIDUrl = (userId: string) => {
+  return `${getProxyPath()}/users/${userId}`;
 };
 
 /**
- * Check whether the server is ready to accept requests
- * @summary Check server readiness
+ * @summary Delete user by ID
  */
-export const getReady = async (options?: RequestInit): Promise<GetReadyDefault> => {
-  return customFetch<GetReadyDefault>(getGetReadyUrl(), {
+export const deleteUserByID = async (userId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteUserByIDUrl(userId), {
     ...options,
-    method: "GET",
+    method: "DELETE",
   });
 };
 
-export const getCreateUserUrl = (params: CreateUserParams) => {
+export const getListUserPasskeysUrl = (userId: string, params?: ListUserPasskeysParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -370,86 +274,102 @@ export const getCreateUserUrl = (params: CreateUserParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/users?${stringifiedParams}`
-    : `${getProxyPath()}/users`;
+    ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}`
+    : `${getProxyPath()}/users/${userId}/passkeys`;
 };
 
 /**
- * @summary Create user
+ * @summary List user passkeys
  */
-export const createUser = async (
-  createUserBody: CreateUserBody,
-  params: CreateUserParams,
+export const listUserPasskeys = async (
+  userId: string,
+  params?: ListUserPasskeysParams,
   options?: RequestInit,
-): Promise<CreateUser201> => {
-  return customFetch<CreateUser201>(getCreateUserUrl(params), {
+): Promise<ListUserPasskeys200> => {
+  return customFetch<ListUserPasskeys200>(getListUserPasskeysUrl(userId, params), {
     ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(createUserBody),
+    method: "GET",
   });
 };
 
-export const getListUsersUrl = (params?: ListUsersParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/users?${stringifiedParams}`
-    : `${getProxyPath()}/users`;
+export const getBeginUserPasskeyRegistrationUrl = (userId: string) => {
+  return `${getProxyPath()}/users/${userId}/passkeys/registrations`;
 };
 
 /**
- * @summary List users
+ * Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+ * @summary Begin passkey registration
  */
-export const listUsers = async (
-  params?: ListUsersParams,
+export const beginUserPasskeyRegistration = async (
+  userId: string,
+  beginUserPasskeyRegistrationBody: BeginUserPasskeyRegistrationBody,
   options?: RequestInit,
-): Promise<ListUsers200Item[]> => {
-  return customFetch<ListUsers200Item[]>(getListUsersUrl(params), {
+): Promise<BeginUserPasskeyRegistration201> => {
+  return customFetch<BeginUserPasskeyRegistration201>(getBeginUserPasskeyRegistrationUrl(userId), {
     ...options,
-    method: "GET",
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(beginUserPasskeyRegistrationBody),
   });
 };
 
-export const getGetUserByIDUrl = (userId: string, params: GetUserByIDParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
+export const getFinishUserPasskeyRegistrationUrl = (userId: string, registrationId: string) => {
+  return `${getProxyPath()}/users/${userId}/passkeys/registrations/${registrationId}`;
+};
 
-  const stringifiedParams = normalizedParams.toString();
+/**
+ * Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+ * @summary Finish passkey registration
+ */
+export const finishUserPasskeyRegistration = async (
+  userId: string,
+  registrationId: string,
+  finishUserPasskeyRegistrationBody: FinishUserPasskeyRegistrationBody,
+  options?: RequestInit,
+): Promise<FinishUserPasskeyRegistration201> => {
+  return customFetch<FinishUserPasskeyRegistration201>(
+    getFinishUserPasskeyRegistrationUrl(userId, registrationId),
+    {
+      ...options,
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...options?.headers },
+      body: JSON.stringify(finishUserPasskeyRegistrationBody),
+    },
+  );
+};
 
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/users/${userId}?${stringifiedParams}`
-    : `${getProxyPath()}/users/${userId}`;
+export const getSetUserPasswordUrl = (userId: string) => {
+  return `${getProxyPath()}/users/${userId}/password`;
 };
 
 /**
- * @summary Get user by ID
+ * @summary Set user password
  */
-export const getUserByID = async (
+export const setUserPassword = async (
   userId: string,
-  params: GetUserByIDParams,
+  setUserPasswordBody: SetUserPasswordBody,
   options?: RequestInit,
-): Promise<GetUserByID200> => {
-  return customFetch<GetUserByID200>(getGetUserByIDUrl(userId, params), {
+): Promise<void> => {
+  return customFetch<void>(getSetUserPasswordUrl(userId), {
     ...options,
-    method: "GET",
+    method: "PUT",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(setUserPasswordBody),
   });
 };
 
-export const getSetUserPasswordUrl = (userId: string, params: SetUserPasswordParams) => {
+export const getListUserTeamsUrl = (userId: string, params?: ListUserTeamsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -461,24 +381,29 @@ export const getSetUserPasswordUrl = (userId: string, params: SetUserPasswordPar
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}`
-    : `${getProxyPath()}/users/${userId}/password`;
+    ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}`
+    : `${getProxyPath()}/users/${userId}/teams`;
 };
 
 /**
- * @summary Set user password
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
  */
-export const setUserPassword = async (
+export const listUserTeams = async (
   userId: string,
-  setUserPasswordBody: SetUserPasswordBody,
-  params: SetUserPasswordParams,
+  params?: ListUserTeamsParams,
   options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getSetUserPasswordUrl(userId, params), {
+): Promise<ListUserTeams200> => {
+  return customFetch<ListUserTeams200>(getListUserTeamsUrl(userId, params), {
     ...options,
-    method: "PUT",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(setUserPasswordBody),
+    method: "GET",
   });
 };
 
@@ -506,7 +431,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -592,29 +517,6 @@ export const submitFlowStep = async (
   });
 };
 
-export const getSubmitFlowEventUrl = (id: string) => {
-  return `${getProxyPath()}/flow/${id}/event`;
-};
-
-/**
- * Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
- * @summary Submit client-side event
- */
-export const submitFlowEvent = async (
-  id: string,
-  submitFlowEventBody: SubmitFlowEventBody,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getSubmitFlowEventUrl(id), {
-    ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(submitFlowEventBody),
-  });
-};
-
 export const getCreateAuthAttemptUrl = () => {
   return `${getProxyPath()}/auth_attempts`;
 };
@@ -773,6 +675,25 @@ export const createProject = async (
   });
 };
 
+export const getQueryProjectsUrl = () => {
+  return `${getProxyPath()}/projects/query`;
+};
+
+/**
+ * @summary Query projects
+ */
+export const queryProjects = async (
+  queryProjectsBody: QueryProjectsBody,
+  options?: RequestInit,
+): Promise<QueryProjects200> => {
+  return customFetch<QueryProjects200>(getQueryProjectsUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(queryProjectsBody),
+  });
+};
+
 export const getGetProjectUrl = (projectId: string) => {
   return `${getProxyPath()}/projects/${projectId}`;
 };
@@ -792,44 +713,56 @@ export const getProject = async (
   });
 };
 
-export const getCreateSessionUrl = () => {
-  return `${getProxyPath()}/sessions`;
+export const getPatchProjectUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}`;
 };
 
 /**
- * Creates an anonymous session shell with no user and no factors (`state: building`).
-
-This is optional — an `auth_attempt` will create a session implicitly if none is provided.
-Use this explicitly when you want to:
-- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
-  can be correlated with the eventual authenticated session from the start.
-- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
-
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+ * Updates the state of a project.
 
-Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
-full session TTL when the first authentication factor is written via a completing `auth_attempt`.
-
- * @summary Create an anonymous session shell
+ * @summary Update project
  */
-export const createSession = async (
-  createSessionBody: CreateSessionBody,
+export const patchProject = async (
+  projectId: string,
+  patchProjectBody: PatchProjectBody,
   options?: RequestInit,
-): Promise<CreateSession201> => {
-  return customFetch<CreateSession201>(getCreateSessionUrl(), {
+): Promise<PatchProject200> => {
+  return customFetch<PatchProject200>(getPatchProjectUrl(projectId), {
     ...options,
-    method: "POST",
+    method: "PATCH",
     headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(createSessionBody),
+    body: JSON.stringify(patchProjectBody),
   });
 };
 
-export const getListSessionsUrl = (params: ListSessionsParams) => {
-  const normalizedParams = new URLSearchParams();
+export const getInitClaimUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
 
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+export const initClaim = async (
+  projectId: string,
+  options?: RequestInit,
+): Promise<InitClaim201> => {
+  return customFetch<InitClaim201>(getInitClaimUrl(projectId), {
+    ...options,
+    method: "POST",
+  });
+};
+
+export const getGetClaimStatusUrl = (projectId: string, params: GetClaimStatusParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
       normalizedParams.append(key, value === null ? "null" : value.toString());
     }
   });
@@ -837,26 +770,131 @@ export const getListSessionsUrl = (params: ListSessionsParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions?${stringifiedParams}`
-    : `${getProxyPath()}/sessions`;
+    ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}`
+    : `${getProxyPath()}/projects/${projectId}/claim/status`;
 };
 
 /**
- * Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
 
- * @summary List sessions
+ * @summary Get claim status
  */
-export const listSessions = async (
-  params: ListSessionsParams,
+export const getClaimStatus = async (
+  projectId: string,
+  params: GetClaimStatusParams,
   options?: RequestInit,
-): Promise<ListSessions200> => {
-  return customFetch<ListSessions200>(getListSessionsUrl(params), {
+): Promise<GetClaimStatus200> => {
+  return customFetch<GetClaimStatus200>(getGetClaimStatusUrl(projectId, params), {
     ...options,
     method: "GET",
   });
 };
 
+export const getCompleteClaimUrl = (projectId: string) => {
+  return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+export const completeClaim = async (
+  projectId: string,
+  completeClaimBody: CompleteClaimBody,
+  options?: RequestInit,
+): Promise<CompleteClaim200> => {
+  return customFetch<CompleteClaim200>(getCompleteClaimUrl(projectId), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(completeClaimBody),
+  });
+};
+
+export const getCreateSessionUrl = () => {
+  return `${getProxyPath()}/sessions`;
+};
+
+/**
+ * Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+  can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+ * @summary Create an anonymous session shell
+ */
+export const createSession = async (
+  createSessionBody: CreateSessionBody,
+  options?: RequestInit,
+): Promise<CreateSession201> => {
+  return customFetch<CreateSession201>(getCreateSessionUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createSessionBody),
+  });
+};
+
+export const getQuerySessionsUrl = (params: QuerySessionsParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/sessions/query?${stringifiedParams}`
+    : `${getProxyPath()}/sessions/query`;
+};
+
+/**
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
+
+ * @summary Query sessions
+ */
+export const querySessions = async (
+  querySessionsBody: QuerySessionsBody,
+  params: QuerySessionsParams,
+  options?: RequestInit,
+): Promise<QuerySessions200> => {
+  return customFetch<QuerySessions200>(getQuerySessionsUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(querySessionsBody),
+  });
+};
+
 export const getExchangeHandoffUrl = (params: ExchangeHandoffParams) => {
   const normalizedParams = new URLSearchParams();
 
@@ -907,20 +945,8 @@ export const exchangeHandoff = async (
   });
 };
 
-export const getGetSessionUrl = (sessionId: string, params: GetSessionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
-    : `${getProxyPath()}/sessions/${sessionId}`;
+export const getGetSessionUrl = (sessionId: string) => {
+  return `${getProxyPath()}/sessions/${sessionId}`;
 };
 
 /**
@@ -935,45 +961,33 @@ against the same `session_id`) to restore a dropped assurance level.
  */
 export const getSession = async (
   sessionId: string,
-  params: GetSessionParams,
   options?: RequestInit,
 ): Promise<GetSession200> => {
-  return customFetch<GetSession200>(getGetSessionUrl(sessionId, params), {
+  return customFetch<GetSession200>(getGetSessionUrl(sessionId), {
     ...options,
     method: "GET",
   });
 };
 
-export const getRevokeSessionUrl = (sessionId: string, params: RevokeSessionParams) => {
-  const normalizedParams = new URLSearchParams();
-
-  Object.entries(params || {}).forEach(([key, value]) => {
-    if (value !== undefined) {
-      normalizedParams.append(key, value === null ? "null" : value.toString());
-    }
-  });
-
-  const stringifiedParams = normalizedParams.toString();
-
-  return stringifiedParams.length > 0
-    ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}`
-    : `${getProxyPath()}/sessions/${sessionId}`;
+export const getRevokeSessionUrl = (sessionId: string) => {
+  return `${getProxyPath()}/sessions/${sessionId}`;
 };
 
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
  * @summary Revoke session
  */
-export const revokeSession = async (
-  sessionId: string,
-  params: RevokeSessionParams,
-  options?: RequestInit,
-): Promise<void> => {
-  return customFetch<void>(getRevokeSessionUrl(sessionId, params), {
+export const revokeSession = async (sessionId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getRevokeSessionUrl(sessionId), {
     ...options,
     method: "DELETE",
   });
@@ -1005,10 +1019,12 @@ export const getRevokeMySessionUrl = () => {
 };
 
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
  * @summary Revoke my session
  */
@@ -1036,10 +1052,12 @@ export const getCreateSchemaUrl = (params: CreateSchemaParams) => {
 };
 
 /**
- * Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1059,7 +1077,39 @@ export const createSchema = async (
   });
 };
 
-export const getGetSchemaByIdUrl = (id: string, params: GetSchemaByIdParams) => {
+export const getListSchemasUrl = (params: ListSchemasParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/schemas?${stringifiedParams}`
+    : `${getProxyPath()}/schemas`;
+};
+
+/**
+ * Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+ * @summary List all schemas
+ */
+export const listSchemas = async (
+  params: ListSchemasParams,
+  options?: RequestInit,
+): Promise<ListSchemas200> => {
+  return customFetch<ListSchemas200>(getListSchemasUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetSchemaByIdUrl = (id: string, params?: GetSchemaByIdParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1076,12 +1126,15 @@ export const getGetSchemaByIdUrl = (id: string, params: GetSchemaByIdParams) =>
 };
 
 /**
- * Get a schema by its ID. This will return the default revision of the schema.
+ * Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
  * @summary Get schema by ID
  */
 export const getSchemaById = async (
   id: string,
-  params: GetSchemaByIdParams,
+  params?: GetSchemaByIdParams,
   options?: RequestInit,
 ): Promise<GetSchemaById200> => {
   return customFetch<GetSchemaById200>(getGetSchemaByIdUrl(id, params), {
@@ -1099,7 +1152,7 @@ export const getCreateFlowDefinitionUrl = () => {
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
-Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
  * @summary Create a new flow definition
  */
@@ -1147,7 +1200,98 @@ export const listFlowDefinitions = async (
   });
 };
 
-export const getGetFlowDefinitionUrl = (id: string, params: GetFlowDefinitionParams) => {
+export const getGetFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+export const getFlowDefinition = async (
+  id: string,
+  options?: RequestInit,
+): Promise<GetFlowDefinition200> => {
+  return customFetch<GetFlowDefinition200>(getGetFlowDefinitionUrl(id), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getUpdateFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+ * @summary Update a flow definition by id
+ */
+export const updateFlowDefinition = async (
+  id: string,
+  updateFlowDefinitionBody: UpdateFlowDefinitionBody,
+  options?: RequestInit,
+): Promise<UpdateFlowDefinition200> => {
+  return customFetch<UpdateFlowDefinition200>(getUpdateFlowDefinitionUrl(id), {
+    ...options,
+    method: "PUT",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(updateFlowDefinitionBody),
+  });
+};
+
+export const getDeleteFlowDefinitionUrl = (id: string) => {
+  return `${getProxyPath()}/flow_definitions/${id}`;
+};
+
+/**
+ * Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+ * @summary Delete a flow definition by id
+ */
+export const deleteFlowDefinition = async (id: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteFlowDefinitionUrl(id), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getCreateTeamUrl = (params: CreateTeamParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/teams?${stringifiedParams}`
+    : `${getProxyPath()}/teams`;
+};
+
+/**
+ * @summary Create team
+ */
+export const createTeam = async (
+  createTeamBody: CreateTeamBody,
+  params: CreateTeamParams,
+  options?: RequestInit,
+): Promise<CreateTeam201> => {
+  return customFetch<CreateTeam201>(getCreateTeamUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createTeamBody),
+  });
+};
+
+export const getQueryTeamsUrl = (params: QueryTeamsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1159,26 +1303,121 @@ export const getGetFlowDefinitionUrl = (id: string, params: GetFlowDefinitionPar
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+    ? `${getProxyPath()}/teams/query?${stringifiedParams}`
+    : `${getProxyPath()}/teams/query`;
 };
 
 /**
- * Get a flow definition by id
- * @summary Get a flow definition by id
+ * Returns the teams of a project, paginated with a cursor.
+
+ * @summary Query teams
  */
-export const getFlowDefinition = async (
-  id: string,
-  params: GetFlowDefinitionParams,
+export const queryTeams = async (
+  queryTeamsBody: QueryTeamsBody,
+  params: QueryTeamsParams,
   options?: RequestInit,
-): Promise<GetFlowDefinition200> => {
-  return customFetch<GetFlowDefinition200>(getGetFlowDefinitionUrl(id, params), {
+): Promise<QueryTeams200> => {
+  return customFetch<QueryTeams200>(getQueryTeamsUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(queryTeamsBody),
+  });
+};
+
+export const getGetTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Returns a Team by its id.
+
+ * @summary Get team
+ */
+export const getTeam = async (teamId: string, options?: RequestInit): Promise<GetTeam200> => {
+  return customFetch<GetTeam200>(getGetTeamUrl(teamId), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getDeleteTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
+ */
+export const deleteTeam = async (teamId: string, options?: RequestInit): Promise<void> => {
+  return customFetch<void>(getDeleteTeamUrl(teamId), {
+    ...options,
+    method: "DELETE",
+  });
+};
+
+export const getUpdateTeamUrl = (teamId: string) => {
+  return `${getProxyPath()}/teams/${teamId}`;
+};
+
+/**
+ * Update team. Only active teams can be updated.
+
+ * @summary Update team
+ */
+export const updateTeam = async (
+  teamId: string,
+  updateTeamBody: UpdateTeamBody,
+  options?: RequestInit,
+): Promise<UpdateTeam200> => {
+  return customFetch<UpdateTeam200>(getUpdateTeamUrl(teamId), {
+    ...options,
+    method: "PATCH",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(updateTeamBody),
+  });
+};
+
+export const getListEnvironmentsUrl = (params: ListEnvironmentsParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/environments?${stringifiedParams}`
+    : `${getProxyPath()}/environments`;
+};
+
+/**
+ * Lists the project's environments ordered by name.
+
+ * @summary List environments
+ */
+export const listEnvironments = async (
+  params: ListEnvironmentsParams,
+  options?: RequestInit,
+): Promise<ListEnvironments200> => {
+  return customFetch<ListEnvironments200>(getListEnvironmentsUrl(params), {
     ...options,
     method: "GET",
   });
 };
 
-export const getUpdateFlowDefinitionUrl = (id: string, params: UpdateFlowDefinitionParams) => {
+export const getGetEnvironmentByNameUrl = (name: string, params: GetEnvironmentByNameParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1190,29 +1429,173 @@ export const getUpdateFlowDefinitionUrl = (id: string, params: UpdateFlowDefinit
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+    ? `${getProxyPath()}/environments/${name}?${stringifiedParams}`
+    : `${getProxyPath()}/environments/${name}`;
 };
 
 /**
- * Update a flow definition by id
- * @summary Update a flow definition by id
+ * Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+ * @summary Get an environment by name
  */
-export const updateFlowDefinition = async (
+export const getEnvironmentByName = async (
+  name: string,
+  params: GetEnvironmentByNameParams,
+  options?: RequestInit,
+): Promise<GetEnvironmentByName200> => {
+  return customFetch<GetEnvironmentByName200>(getGetEnvironmentByNameUrl(name, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateBrandingUrl = (params: CreateBrandingParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/branding?${stringifiedParams}`
+    : `${getProxyPath()}/branding`;
+};
+
+/**
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+ * @summary Publish a new branding revision
+ */
+export const createBranding = async (
+  createBrandingBody: CreateBrandingBody,
+  params: CreateBrandingParams,
+  options?: RequestInit,
+): Promise<CreateBranding201> => {
+  return customFetch<CreateBranding201>(getCreateBrandingUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createBrandingBody),
+  });
+};
+
+export const getListBrandingUrl = (params: ListBrandingParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/branding?${stringifiedParams}`
+    : `${getProxyPath()}/branding`;
+};
+
+/**
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+ * @summary List branding revisions
+ */
+export const listBranding = async (
+  params: ListBrandingParams,
+  options?: RequestInit,
+): Promise<ListBranding200Item[]> => {
+  return customFetch<ListBranding200Item[]>(getListBrandingUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetBrandingByIdUrl = (id: string) => {
+  return `${getProxyPath()}/branding/${id}`;
+};
+
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
+ */
+export const getBrandingById = async (
   id: string,
-  updateFlowDefinitionBody: UpdateFlowDefinitionBody,
-  params: UpdateFlowDefinitionParams,
   options?: RequestInit,
-): Promise<UpdateFlowDefinition200> => {
-  return customFetch<UpdateFlowDefinition200>(getUpdateFlowDefinitionUrl(id, params), {
+): Promise<GetBrandingById200> => {
+  return customFetch<GetBrandingById200>(getGetBrandingByIdUrl(id), {
     ...options,
-    method: "PATCH",
+    method: "GET",
+  });
+};
+
+export const getCreateReleaseUrl = (params: CreateReleaseParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/releases?${stringifiedParams}`
+    : `${getProxyPath()}/releases`;
+};
+
+/**
+ * Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+ * @summary Create a release
+ */
+export const createRelease = async (
+  createReleaseBody: CreateReleaseBody,
+  params: CreateReleaseParams,
+  options?: RequestInit,
+): Promise<CreateRelease200 | CreateRelease201> => {
+  return customFetch<CreateRelease200 | CreateRelease201>(getCreateReleaseUrl(params), {
+    ...options,
+    method: "POST",
     headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(updateFlowDefinitionBody),
+    body: JSON.stringify(createReleaseBody),
   });
 };
 
-export const getDeleteFlowDefinitionUrl = (id: string, params: DeleteFlowDefinitionParams) => {
+export const getListReleasesUrl = (params: ListReleasesParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1224,29 +1607,195 @@ export const getDeleteFlowDefinitionUrl = (id: string, params: DeleteFlowDefinit
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}`
-    : `${getProxyPath()}/flow_definitions/${id}`;
+    ? `${getProxyPath()}/releases?${stringifiedParams}`
+    : `${getProxyPath()}/releases`;
 };
 
 /**
- * Delete a flow definition by id
- * @summary Delete a flow definition by id
+ * Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+ * @summary List releases
+ */
+export const listReleases = async (
+  params: ListReleasesParams,
+  options?: RequestInit,
+): Promise<ListReleases200> => {
+  return customFetch<ListReleases200>(getListReleasesUrl(params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getGetReleaseByIdUrl = (releaseId: string, params: GetReleaseByIdParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/releases/${releaseId}?${stringifiedParams}`
+    : `${getProxyPath()}/releases/${releaseId}`;
+};
+
+/**
+ * Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+ * @summary Get a release by id
+ */
+export const getReleaseById = async (
+  releaseId: string,
+  params: GetReleaseByIdParams,
+  options?: RequestInit,
+): Promise<GetReleaseById200> => {
+  return customFetch<GetReleaseById200>(getGetReleaseByIdUrl(releaseId, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getCreateGrantUrl = (params: CreateGrantParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/grants?${stringifiedParams}`
+    : `${getProxyPath()}/grants`;
+};
+
+/**
+ * Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+ * @summary Create grant
+ */
+export const createGrant = async (
+  createGrantBody: CreateGrantBody,
+  params: CreateGrantParams,
+  options?: RequestInit,
+): Promise<CreateGrant201> => {
+  return customFetch<CreateGrant201>(getCreateGrantUrl(params), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(createGrantBody),
+  });
+};
+
+export const getGetGrantUrl = (id: string, params: GetGrantParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/grants/${id}?${stringifiedParams}`
+    : `${getProxyPath()}/grants/${id}`;
+};
+
+/**
+ * Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+ * @summary Get grant
+ */
+export const getGrant = async (
+  id: string,
+  params: GetGrantParams,
+  options?: RequestInit,
+): Promise<GetGrant200> => {
+  return customFetch<GetGrant200>(getGetGrantUrl(id, params), {
+    ...options,
+    method: "GET",
+  });
+};
+
+export const getDeleteGrantUrl = (id: string, params: DeleteGrantParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `${getProxyPath()}/grants/${id}?${stringifiedParams}`
+    : `${getProxyPath()}/grants/${id}`;
+};
+
+/**
+ * Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+ * @summary Revoke grant
  */
-export const deleteFlowDefinition = async (
+export const deleteGrant = async (
   id: string,
-  params: DeleteFlowDefinitionParams,
+  params: DeleteGrantParams,
   options?: RequestInit,
 ): Promise<void> => {
-  return customFetch<void>(getDeleteFlowDefinitionUrl(id, params), {
+  return customFetch<void>(getDeleteGrantUrl(id, params), {
     ...options,
     method: "DELETE",
   });
 };
 
-export const getCreateTeamUrl = (params: CreateTeamParams) => {
+export const getListEventsUrl = (params: ListEventsParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
+    const explodeParameters = ["category", "event_type"];
+
+    if (Array.isArray(value) && explodeParameters.includes(key)) {
+      value.forEach((v) => {
+        normalizedParams.append(key, v === null ? "null" : v.toString());
+      });
+      return;
+    }
+
     if (value !== undefined) {
       normalizedParams.append(key, value === null ? "null" : value.toString());
     }
@@ -1255,27 +1804,36 @@ export const getCreateTeamUrl = (params: CreateTeamParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/teams?${stringifiedParams}`
-    : `${getProxyPath()}/teams`;
+    ? `${getProxyPath()}/events?${stringifiedParams}`
+    : `${getProxyPath()}/events`;
 };
 
 /**
- * @summary Create team
+ * Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+ * @summary List events
  */
-export const createTeam = async (
-  params: CreateTeamParams,
-  createTeamBody?: CreateTeamBody,
+export const listEvents = async (
+  params: ListEventsParams,
   options?: RequestInit,
-): Promise<CreateTeam201> => {
-  return customFetch<CreateTeam201>(getCreateTeamUrl(params), {
+): Promise<ListEvents200> => {
+  return customFetch<ListEvents200>(getListEventsUrl(params), {
     ...options,
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...options?.headers },
-    body: JSON.stringify(createTeamBody),
+    method: "GET",
   });
 };
 
-export const getGetTeamUrl = (teamId: string, params: GetTeamParams) => {
+export const getGetEventUrl = (id: string, params: GetEventParams) => {
   const normalizedParams = new URLSearchParams();
 
   Object.entries(params || {}).forEach(([key, value]) => {
@@ -1287,21 +1845,25 @@ export const getGetTeamUrl = (teamId: string, params: GetTeamParams) => {
   const stringifiedParams = normalizedParams.toString();
 
   return stringifiedParams.length > 0
-    ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}`
-    : `${getProxyPath()}/teams/${teamId}`;
+    ? `${getProxyPath()}/events/${id}?${stringifiedParams}`
+    : `${getProxyPath()}/events/${id}`;
 };
 
 /**
- * Returns the current state of a team.
+ * Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
 
- * @summary Get team
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+ * @summary Get event by ID
  */
-export const getTeam = async (
-  teamId: string,
-  params: GetTeamParams,
+export const getEvent = async (
+  id: string,
+  params: GetEventParams,
   options?: RequestInit,
-): Promise<GetTeam200> => {
-  return customFetch<GetTeam200>(getGetTeamUrl(teamId, params), {
+): Promise<GetEvent200> => {
+  return customFetch<GetEvent200>(getGetEventUrl(id, params), {
     ...options,
     method: "GET",
   });