@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/getFlowStepDefault.ts

@@ -5,16 +5,115 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetFlowStepDefaultDetails } from "./getFlowStepDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type GetFlowStepDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: GetFlowStepDefaultDetails;
-};
+export type GetFlowStepDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.decrypt_failed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.completed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_expired";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.integrity";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "tkn.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.unknown_alg";
+    });

package/src/generated/model/getGrant200.ts

@@ -0,0 +1,34 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetGrant200ObjectType } from "./getGrant200ObjectType";
+import type { GetGrant200PrincipalType } from "./getGrant200PrincipalType";
+import type { GetGrant200Relation } from "./getGrant200Relation";
+
+/**
+ * A collaboration grant binding a principal to a project relation.
+ */
+export type GetGrant200 = {
+  /** Managed assignment id (`asgn_<opaque>`). */
+  id: string;
+  /** Project this grant is scoped to. */
+  project_id: string;
+  /** Kind of principal bound by this grant. */
+  principal_type: GetGrant200PrincipalType;
+  /** Principal id (`user_<opaque>` or `team_<opaque>`). */
+  principal_id: string;
+  /** Catalog object type. Always `project` for this API. */
+  object_type: GetGrant200ObjectType;
+  /** Catalog relation on the project. */
+  relation: GetGrant200Relation;
+  /** When the grant was created. */
+  created_at: string;
+  /** When the grant expires. Null when it does not expire. GET still
+  returns expired unrevoked grants; authorization ignores them.
+   */
+  expires_at?: string | null;
+};

package/src/generated/model/getGrant200ObjectType.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Catalog object type. Always `project` for this API.
+ */
+export type GetGrant200ObjectType =
+  (typeof GetGrant200ObjectType)[keyof typeof GetGrant200ObjectType];
+
+export const GetGrant200ObjectType = {
+  project: "project",
+} as const;

package/src/generated/model/getGrant200PrincipalType.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Kind of principal bound by this grant.
+ */
+export type GetGrant200PrincipalType =
+  (typeof GetGrant200PrincipalType)[keyof typeof GetGrant200PrincipalType];
+
+export const GetGrant200PrincipalType = {
+  user: "user",
+  team: "team",
+} as const;

package/src/generated/model/getGrant200Relation.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Catalog relation on the project.
+ */
+export type GetGrant200Relation = (typeof GetGrant200Relation)[keyof typeof GetGrant200Relation];
+
+export const GetGrant200Relation = {
+  viewer: "viewer",
+  editor: "editor",
+  admin: "admin",
+} as const;

package/src/generated/model/getGrant401.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetGrant401Details } from "./getGrant401Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetGrant401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetGrant401Details;
+};

package/src/generated/model/{listUsers500Details.ts → getGrant401Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type ListUsers500Details = { [key: string]: unknown };
+export type GetGrant401Details = { [key: string]: unknown };

package/src/generated/model/getGrant403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetGrant403Details } from "./getGrant403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetGrant403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetGrant403Details;
+};

package/src/generated/model/getGrant403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetGrant403Details = { [key: string]: unknown };

package/src/generated/model/getGrant404.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetGrant404Details } from "./getGrant404Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetGrant404 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetGrant404Details;
+};

package/src/generated/model/getGrant404Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetGrant404Details = { [key: string]: unknown };

package/src/generated/model/getGrantDefault.ts

@@ -0,0 +1,59 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type GetGrantDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "grant.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "grant.permission_denied";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    });

package/src/generated/model/{getSessionParams.ts → getGrantParams.ts}

@@ -6,7 +6,7 @@
  * OpenAPI spec version: 0.0.1
  */
 
-export type GetSessionParams = {
+export type GetGrantParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$

package/src/generated/model/getMySession200.ts

@@ -8,6 +8,7 @@
 import type { GetMySession200FactorsItem } from "./getMySession200FactorsItem";
 import type { GetMySession200Metadata } from "./getMySession200Metadata";
 import type { GetMySession200State } from "./getMySession200State";
+import type { GetMySession200User } from "./getMySession200User";
 import type { GetMySession200UserAgent } from "./getMySession200UserAgent";
 
 /**
@@ -21,23 +22,29 @@ in through `auth_attempts`.
  */
 export type GetMySession200 = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: GetMySession200State;
   /** The authenticated user. Null for anonymous sessions and until the `user`
   factor has been verified through an `auth_attempt`.
    */
   user_id?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+   */
+  user?: GetMySession200User;
   /** Verified authentication factors accumulated by this session.
   Each key is a factor type (e.g. `password`, `totp`, `passkey`).
   Each value is a factor event object with at least `verified_at` and

package/src/generated/model/getMySession200State.ts

@@ -8,10 +8,9 @@
 
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 export type GetMySession200State = (typeof GetMySession200State)[keyof typeof GetMySession200State];
@@ -20,5 +19,4 @@ export const GetMySession200State = {
   building: "building",
   active: "active",
   expired: "expired",
-  revoked: "revoked",
 } as const;

package/src/generated/model/getMySession200User.ts

@@ -0,0 +1,37 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+
+ */
+export type GetMySession200User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/getMySession401.ts

@@ -5,10 +5,12 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetMySession401Details } from "./getMySession401Details";
 
 /**
- * Standard error payload returned for failed API requests.
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
  */
 export type GetMySession401 = {
   /** Stable machine-readable error code. */
@@ -16,5 +18,7 @@ export type GetMySession401 = {
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetMySession401Details;
+  details?: { [key: string]: unknown };
+} & {
+  code: "auth.unauthorized";
 };

package/src/generated/model/getMySession404.ts

@@ -5,10 +5,12 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetMySession404Details } from "./getMySession404Details";
 
 /**
- * Standard error payload returned for failed API requests.
+ * The session was not found
+
+Error code: sess.not_found
+
  */
 export type GetMySession404 = {
   /** Stable machine-readable error code. */
@@ -16,5 +18,7 @@ export type GetMySession404 = {
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: GetMySession404Details;
+  details?: { [key: string]: unknown };
+} & {
+  code: "sess.not_found";
 };

package/src/generated/model/getMySessionDefault.ts

@@ -5,16 +5,45 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetMySessionDefaultDetails } from "./getMySessionDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type GetMySessionDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: GetMySessionDefaultDetails;
-};
+export type GetMySessionDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.not_found";
+    });

package/src/generated/model/getMyUser200.ts

@@ -5,5 +5,67 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+import type { GetMyUser200Attributes } from "./getMyUser200Attributes";
+import type { GetMyUser200Metadata } from "./getMyUser200Metadata";
+import type { GetMyUser200TeamsItem } from "./getMyUser200TeamsItem";
 
-export type GetMyUser200 = { [key: string]: unknown };
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity.
+
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
+
+ */
+export type GetMyUser200 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetMyUser200Attributes;
+  metadata: GetMyUser200Metadata;
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+  readonly display?: string;
+  /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+   */
+  readonly teams?: readonly GetMyUser200TeamsItem[];
+  /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+   */
+  readonly teams_truncated?: boolean;
+};