@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/getSchemaById200.ts

@@ -5,79 +5,27 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+import type { GetSchemaById200Metadata } from "./getSchemaById200Metadata";
+import type { GetSchemaById200Schema } from "./getSchemaById200Schema";
 
+/**
+ * A schema resource: the server-owned envelope around a customer-authored
+JSON Schema document.
+
+`schema` is the customer-authored document, served verbatim: its keys and
+contents are defined entirely by its author. The rest of the object — `id`,
+`metadata` — is the server-owned envelope. Keeping the two apart means the
+document may declare any property (including `id` or `metadata`) without
+colliding with the envelope, and the resource `id` stays distinguishable
+from the document's own `$id`.
+
+ */
 export type GetSchemaById200 = {
-  /** Discriminator value for a user schema create request. */
-  kind: "user-schema";
-  /** The user Schema version used for this schema. */
-  metaSchema: string;
-  /** A list of authentication methods supported by the user definition. */
-  "x-auth-methods": {
-    password?: {
-      /** Whether the authentication method is enabled or not */
-      enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
-    };
-    passkey?: {
-      /** Whether the authentication method is enabled or not */
-      enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
-    };
-    magic_link?: {
-      /** Whether the authentication method is enabled or not */
-      enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
-    };
-    sso?: {
-      /** Whether the authentication method is enabled or not */
-      enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
-    };
-    otp?: {
-      /** Whether the authentication method is enabled or not */
-      enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
-    };
-  };
-  /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
-  properties?: {
-    [key: string]: {
-      /** The verification method for this property, if applicable */
-      "x-verify"?: string | null;
-      /** The level of uniqueness for this property, if applicable */
-      "x-unique"?: "unspecified" | "project" | "team" | null;
-      /** The claim name for this property, if applicable */
-      "x-claim"?: string | null;
-      /** Whether this property is editable by the user or not */
-      "x-editable"?: boolean;
-      /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean;
-      /** Whether this property is used for multi-factor authentication or not */
-      "x-mfa"?: boolean;
-      /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
-      properties?: { [key: string]: unknown };
-      [key: string]: unknown;
-    };
-  };
-  [key: string]: unknown;
+  /** The resource id: the server-minted `sch_*` identifier, or the
+  customer-supplied `$id` URI when the document declared one at creation.
+   */
+  readonly id: string;
+  /** The customer-authored JSON Schema document, served verbatim. */
+  schema: GetSchemaById200Schema;
+  metadata: GetSchemaById200Metadata;
 };

package/src/generated/model/getSchemaById200Metadata.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type GetSchemaById200Metadata = {
+  /** The time when the schema was created. */
+  created_at: string;
+};

package/src/generated/model/getSchemaById200Schema.ts

@@ -0,0 +1,88 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The customer-authored JSON Schema document, served verbatim.
+ */
+export type GetSchemaById200Schema = {
+  /**
+     * The type of user this schema describes. This is a customer chosen name.
+
+     * @maxLength 256
+     */
+  objectType?: string;
+  /** Discriminator value for a user schema create request. */
+  kind: "user-schema";
+  /** The user Schema version used for this schema. */
+  metaSchema: string;
+  /** A list of authentication methods supported by the user definition. */
+  "x-auth-methods": {
+    password?: {
+      /** Whether the authentication method is enabled or not */
+      enabled: boolean;
+    };
+    passkey?: {
+      /** Whether the authentication method is enabled or not */
+      enabled: boolean;
+    };
+    magic_link?: {
+      /** Whether the authentication method is enabled or not */
+      enabled: boolean;
+    };
+    sso?: {
+      /** Whether the authentication method is enabled or not */
+      enabled: boolean;
+    };
+    otp?: {
+      /** Whether the authentication method is enabled or not */
+      enabled: boolean;
+    };
+  };
+  /**
+     * Path of the leaf property whose value identifies a user (nested leaves
+  are addressed by their dot-joined attribute path). The property must
+  carry `x-unique` "project". Required when an auth method needing
+  identifier-first dispatch (password) is enabled. Passkey is exempt:
+  discoverable credentials identify the user through the assertion
+  itself, so passkey-only and API-managed schemas may designate nothing;
+  flows using identifier-first passkey are validated at the flow level
+  instead.
+
+     * @minLength 1
+     */
+  "x-identifier"?: string;
+  /**
+     * Ordered leaf property paths whose values, joined with a space, render
+  the user's display name.
+
+     * @minItems 1
+     */
+  "x-display"?: string[];
+  /** A map of additional properties for the user definition, where the
+  key is the property name and the value is the property schema
+   */
+  properties?: {
+    [key: string]: {
+      /** The level of uniqueness for this property, if applicable */
+      "x-unique"?: "unspecified" | "project" | "team" | null;
+      /** The claim name for this property, if applicable */
+      "x-claim"?: string | null;
+      /** Whether this property's value may appear in audit event payloads. Audit
+  payloads are deny-by-default: a property without this annotation
+  contributes its key but never its value.
+   */
+      "x-audit"?: boolean;
+      /** A map of additional properties for the user definition, where the key is
+  the property name and the value is the property schema.
+   */
+      properties?: { [key: string]: unknown };
+      [key: string]: unknown;
+    };
+  };
+  [key: string]: unknown;
+};

package/src/generated/model/getSchemaByIdParams.ts

@@ -7,11 +7,6 @@
  */
 
 export type GetSchemaByIdParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
   /**
    * The unique identifier of the team
    * @pattern ^[a-zA-Z0-9_-]+$

package/src/generated/model/getSession200.ts

@@ -8,6 +8,7 @@
 import type { GetSession200FactorsItem } from "./getSession200FactorsItem";
 import type { GetSession200Metadata } from "./getSession200Metadata";
 import type { GetSession200State } from "./getSession200State";
+import type { GetSession200User } from "./getSession200User";
 import type { GetSession200UserAgent } from "./getSession200UserAgent";
 
 /**
@@ -21,23 +22,29 @@ in through `auth_attempts`.
  */
 export type GetSession200 = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: GetSession200State;
   /** The authenticated user. Null for anonymous sessions and until the `user`
   factor has been verified through an `auth_attempt`.
    */
   user_id?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+   */
+  user?: GetSession200User;
   /** Verified authentication factors accumulated by this session.
   Each key is a factor type (e.g. `password`, `totp`, `passkey`).
   Each value is a factor event object with at least `verified_at` and

package/src/generated/model/getSession200State.ts

@@ -8,10 +8,9 @@
 
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 export type GetSession200State = (typeof GetSession200State)[keyof typeof GetSession200State];
@@ -20,5 +19,4 @@ export const GetSession200State = {
   building: "building",
   active: "active",
   expired: "expired",
-  revoked: "revoked",
 } as const;

package/src/generated/model/getSession200User.ts

@@ -0,0 +1,37 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+
+ */
+export type GetSession200User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/getSession403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetSession403Details } from "./getSession403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetSession403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetSession403Details;
+};

package/src/generated/model/getSession403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetSession403Details = { [key: string]: unknown };

package/src/generated/model/getSessionDefault.ts

@@ -5,16 +5,55 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { GetSessionDefaultDetails } from "./getSessionDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type GetSessionDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: GetSessionDefaultDetails;
-};
+export type GetSessionDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.permission_denied";
+    });

package/src/generated/model/getTeam200.ts

@@ -5,15 +5,24 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+import type { GetTeam200Status } from "./getTeam200Status";
 
 /**
- * The current state of a team.
+ * Details of a team.
  */
 export type GetTeam200 = {
   /** The unique identifier of the team. */
   id: string;
+  /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: GetTeam200Status;
   /** The time when the team was created. */
-  createdAt: string;
+  created_at: string;
   /** The time when the team was last updated. */
-  updatedAt: string;
+  updated_at: string;
 };

package/src/generated/model/getTeam200Status.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
+ */
+export type GetTeam200Status = (typeof GetTeam200Status)[keyof typeof GetTeam200Status];
+
+export const GetTeam200Status = {
+  active: "active",
+  deactivated: "deactivated",
+} as const;

package/src/generated/model/getUserByID200.ts

@@ -5,5 +5,67 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+import type { GetUserByID200Attributes } from "./getUserByID200Attributes";
+import type { GetUserByID200Metadata } from "./getUserByID200Metadata";
+import type { GetUserByID200TeamsItem } from "./getUserByID200TeamsItem";
 
-export type GetUserByID200 = { [key: string]: unknown };
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity.
+
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
+
+ */
+export type GetUserByID200 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetUserByID200Attributes;
+  metadata: GetUserByID200Metadata;
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+  readonly display?: string;
+  /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+   */
+  readonly teams?: readonly GetUserByID200TeamsItem[];
+  /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+   */
+  readonly teams_truncated?: boolean;
+};

package/src/generated/model/getUserByID200Attributes.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+export type GetUserByID200Attributes = { [key: string]: unknown };

package/src/generated/model/getUserByID200Metadata.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetUserByID200MetadataLifecycleOwnerTeam } from "./getUserByID200MetadataLifecycleOwnerTeam";
+import type { GetUserByID200MetadataStatus } from "./getUserByID200MetadataStatus";
+
+export type GetUserByID200Metadata = {
+  /** The time when the user was created. */
+  created_at: string;
+  /** The time when the user was last updated. */
+  updated_at: string;
+  /** The status of the user. */
+  status: GetUserByID200MetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team memberships: it decides who may deprovision the user, not
+  which teams the user collaborates in. Memberships are their own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+  /** The team named by `lifecycle_owner_team_id`, present only when the
+  request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+  Absent means it was not requested; `null` means the user is self-owned
+  and there is no owner to resolve.
+
+  Requesting it does not guarantee it is present on every user. Today
+  `team.read` is checked once for the whole request, so it is; once that
+  check is per team, a page may contain a user whose owner the caller may
+  not read, and such a row answers with neither the team nor `null` —
+  `null` already means self-owned. What it answers with instead is decided
+  with the granular scopes (#420); do not read the two cases above as the
+  complete set.
+
+  This is the same representation `GET /teams/{team_id}` serves. It is a
+  single team, not a collection, so it carries no cap and no truncation
+  flag.
+   */
+  readonly lifecycle_owner_team?: GetUserByID200MetadataLifecycleOwnerTeam;
+};

package/src/generated/model/getUserByID200MetadataLifecycleOwnerTeam.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The team named by `lifecycle_owner_team_id`, present only when the
+request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+Absent means it was not requested; `null` means the user is self-owned
+and there is no owner to resolve.
+
+Requesting it does not guarantee it is present on every user. Today
+`team.read` is checked once for the whole request, so it is; once that
+check is per team, a page may contain a user whose owner the caller may
+not read, and such a row answers with neither the team nor `null` —
+`null` already means self-owned. What it answers with instead is decided
+with the granular scopes (#420); do not read the two cases above as the
+complete set.
+
+This is the same representation `GET /teams/{team_id}` serves. It is a
+single team, not a collection, so it carries no cap and no truncation
+flag.
+
+ */
+export type GetUserByID200MetadataLifecycleOwnerTeam = {
+  /** The unique identifier of the team. */
+  id: string;
+  /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: "active" | "deactivated";
+  /** The time when the team was created. */
+  created_at: string;
+  /** The time when the team was last updated. */
+  updated_at: string;
+} | null;

package/src/generated/model/getUserByID200MetadataStatus.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The status of the user.
+ */
+export type GetUserByID200MetadataStatus =
+  (typeof GetUserByID200MetadataStatus)[keyof typeof GetUserByID200MetadataStatus];
+
+export const GetUserByID200MetadataStatus = {
+  active: "active",
+  suspended: "suspended",
+  deactivated: "deactivated",
+  pending_purge: "pending_purge",
+} as const;