@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/{getOpenIDConfiguration4xxDetails.ts → queryUsers200UsersItemAttributes.ts}

@@ -7,6 +7,8 @@
  */
 
 /**
- * Additional error-specific context.
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
  */
-export type GetOpenIDConfiguration4xxDetails = { [key: string]: unknown };
+export type QueryUsers200UsersItemAttributes = { [key: string]: unknown };

package/src/generated/model/queryUsers200UsersItemMetadata.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsers200UsersItemMetadataLifecycleOwnerTeam } from "./queryUsers200UsersItemMetadataLifecycleOwnerTeam";
+import type { QueryUsers200UsersItemMetadataStatus } from "./queryUsers200UsersItemMetadataStatus";
+
+export type QueryUsers200UsersItemMetadata = {
+  /** The time when the user was created. */
+  created_at: string;
+  /** The time when the user was last updated. */
+  updated_at: string;
+  /** The status of the user. */
+  status: QueryUsers200UsersItemMetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team memberships: it decides who may deprovision the user, not
+  which teams the user collaborates in. Memberships are their own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+  /** The team named by `lifecycle_owner_team_id`, present only when the
+  request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+  Absent means it was not requested; `null` means the user is self-owned
+  and there is no owner to resolve.
+
+  Requesting it does not guarantee it is present on every user. Today
+  `team.read` is checked once for the whole request, so it is; once that
+  check is per team, a page may contain a user whose owner the caller may
+  not read, and such a row answers with neither the team nor `null` —
+  `null` already means self-owned. What it answers with instead is decided
+  with the granular scopes (#420); do not read the two cases above as the
+  complete set.
+
+  This is the same representation `GET /teams/{team_id}` serves. It is a
+  single team, not a collection, so it carries no cap and no truncation
+  flag.
+   */
+  readonly lifecycle_owner_team?: QueryUsers200UsersItemMetadataLifecycleOwnerTeam;
+};

package/src/generated/model/queryUsers200UsersItemMetadataLifecycleOwnerTeam.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The team named by `lifecycle_owner_team_id`, present only when the
+request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+Absent means it was not requested; `null` means the user is self-owned
+and there is no owner to resolve.
+
+Requesting it does not guarantee it is present on every user. Today
+`team.read` is checked once for the whole request, so it is; once that
+check is per team, a page may contain a user whose owner the caller may
+not read, and such a row answers with neither the team nor `null` —
+`null` already means self-owned. What it answers with instead is decided
+with the granular scopes (#420); do not read the two cases above as the
+complete set.
+
+This is the same representation `GET /teams/{team_id}` serves. It is a
+single team, not a collection, so it carries no cap and no truncation
+flag.
+
+ */
+export type QueryUsers200UsersItemMetadataLifecycleOwnerTeam = {
+  /** The unique identifier of the team. */
+  id: string;
+  /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: "active" | "deactivated";
+  /** The time when the team was created. */
+  created_at: string;
+  /** The time when the team was last updated. */
+  updated_at: string;
+} | null;

package/src/generated/model/queryUsers200UsersItemMetadataStatus.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The status of the user.
+ */
+export type QueryUsers200UsersItemMetadataStatus =
+  (typeof QueryUsers200UsersItemMetadataStatus)[keyof typeof QueryUsers200UsersItemMetadataStatus];
+
+export const QueryUsers200UsersItemMetadataStatus = {
+  active: "active",
+  suspended: "suspended",
+  deactivated: "deactivated",
+  pending_purge: "pending_purge",
+} as const;

package/src/generated/model/queryUsers200UsersItemTeamsItem.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsers200UsersItemTeamsItemMembershipStatus } from "./queryUsers200UsersItemTeamsItemMembershipStatus";
+
+/**
+ * One entry of a user's team roster: a team the user belongs to, with the
+membership's participation state. The team's `name` travels with the entry, so
+a page renders without a follow-up `POST /teams/query` per row.
+
+Roster membership is not lifecycle ownership. A user can belong to many teams
+while still owning their own lifecycle — that single owning team is reported
+as `metadata.lifecycle_owner_team_id` on the user itself.
+
+ */
+export type QueryUsers200UsersItemTeamsItem = {
+  /** The unique identifier of the team. */
+  id: string;
+  /** The name of the team. */
+  name: string;
+  /** The user's participation state on this team. Memberships the user was
+  removed from are not returned.
+   */
+  membership_status: QueryUsers200UsersItemTeamsItemMembershipStatus;
+  /** The time when the user joined this team. */
+  created_at: string;
+  /** The time when this membership was last changed. */
+  updated_at: string;
+};

package/src/generated/model/queryUsers200UsersItemTeamsItemMembershipStatus.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The user's participation state on this team. Memberships the user was
+removed from are not returned.
+
+ */
+export type QueryUsers200UsersItemTeamsItemMembershipStatus =
+  (typeof QueryUsers200UsersItemTeamsItemMembershipStatus)[keyof typeof QueryUsers200UsersItemTeamsItemMembershipStatus];
+
+export const QueryUsers200UsersItemTeamsItemMembershipStatus = {
+  pending: "pending",
+  active: "active",
+  inactive: "inactive",
+} as const;

package/src/generated/model/queryUsers400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsers400Details } from "./queryUsers400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryUsers400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryUsers400Details;
+};

package/src/generated/model/queryUsers400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryUsers400Details = { [key: string]: unknown };

package/src/generated/model/queryUsers401.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsers401Details } from "./queryUsers401Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryUsers401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryUsers401Details;
+};

package/src/generated/model/queryUsers401Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryUsers401Details = { [key: string]: unknown };

package/src/generated/model/queryUsers403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsers403Details } from "./queryUsers403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryUsers403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryUsers403Details;
+};

package/src/generated/model/queryUsers403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryUsers403Details = { [key: string]: unknown };

package/src/generated/model/queryUsersBody.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsersBodyExpandItem } from "./queryUsersBodyExpandItem";
+import type { QueryUsersBodyFilterItem } from "./queryUsersBodyFilterItem";
+import type { QueryUsersBodySorting } from "./queryUsersBodySorting";
+
+/**
+ * Request to query the users of a project.
+ */
+export type QueryUsersBody = {
+  /**
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /** Token to retrieve the next page of results. Must be sent with the same
+  `sorting` as the request that issued the token. Omitting `sorting` reuses
+  the default sort and only succeeds when that default matches the token.
+   */
+  page_token?: string | null;
+  /** Related collections to embed on each user (ADR 059). Omit it and no
+  embedded collection is returned. An unrecognised value is rejected.
+   */
+  expand?: QueryUsersBodyExpandItem[];
+  sorting?: QueryUsersBodySorting;
+  /** Filter criteria for querying users. Criteria are combined with AND. */
+  filter?: QueryUsersBodyFilterItem[];
+};

package/src/generated/model/queryUsersBodyExpandItem.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A related object to embed on each returned user (ADR 059).
+
+- `teams`: the user's team memberships, as `teams` on each user. The property
+  is omitted entirely when not requested and `[]` when the user has none, so
+  "did not ask" is distinguishable from "there are none". Embedded lists are
+  capped and are not paginated: past the cap the user carries
+  `teams_truncated: true` and the whole list is read at
+  `GET /users/{user_id}/teams`.
+
+  Membership is team participation, not lifecycle ownership — the
+  owning team stays at `metadata.lifecycle_owner_team_id` (ADR 024).
+
+  Requires `team_membership.read` in addition to `user.read`.
+
+- `lifecycle_owner_team`: the team that owns the user's identity lifecycle,
+  as `metadata.lifecycle_owner_team`. It resolves the id already carried at
+  `metadata.lifecycle_owner_team_id`, and serves the same representation as
+  `GET /teams/{team_id}`. The property is omitted when not requested and
+  `null` when the user is self-owned. One team, so no cap and no truncation
+  flag.
+
+  Requires `team.read` in addition to `user.read`.
+
+The two are independent: asking for one says nothing about the other, and
+neither implies the other's permission.
+
+ */
+export type QueryUsersBodyExpandItem =
+  (typeof QueryUsersBodyExpandItem)[keyof typeof QueryUsersBodyExpandItem];
+
+export const QueryUsersBodyExpandItem = {
+  teams: "teams",
+  lifecycle_owner_team: "lifecycle_owner_team",
+} as const;

package/src/generated/model/queryUsersBodyFilterItem.ts

@@ -0,0 +1,53 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsersBodyFilterItemField } from "./queryUsersBodyFilterItemField";
+import type { QueryUsersBodyFilterItemOperation } from "./queryUsersBodyFilterItemOperation";
+
+export type QueryUsersBodyFilterItem = {
+  /** Field to filter users by:
+  - `created_at`: RFC3339 timestamp
+  - `id`: user id
+  - `schema`: the schema the user's attributes satisfy, matched against the
+    value the user carries as `schema`
+  - `status`: one of `active`, `suspended`, `deactivated`, `pending_purge`
+  - `team_id`: restricts the result to users holding an **active** membership
+    in that team. A user who has been invited but has not accepted does not
+    match. `equals` is the only operation, and the field may be given once —
+    this names one team, not a set.
+  - `lifecycle_owner_team_id`: the team that owns the user's identity
+    lifecycle. The column is nullable for self-owned users, and a null filter
+    value is rejected, so self-owned users cannot be selected by this field.
+
+  **The two team fields answer different questions.** `team_id` is membership:
+  which team the user collaborates in, readable per user at
+  `GET /users/{user_id}/teams`. `lifecycle_owner_team_id` is ownership: which
+  team may deprovision the user. A user can belong to many teams while owning
+  their own lifecycle, so the two disagree often and neither implies the other
+  (ADR 024).
+
+  `team_id` is filterable but not sortable — it is not a column on the user, so
+  it is absent from the sort-field enum.
+
+  Filtering on `team_id` requires `team_membership.read` in addition to
+  `user.read`: it reads the same memberships that `expand: ["teams"]` embeds.
+   */
+  field: QueryUsersBodyFilterItemField;
+  /** Filter-value specifies which values can be filtered by a query endpoint. This
+  is a union of types. When a value is specified which is not assignable to the
+  field which is being filtered, a 400 error will be returned.
+   */
+  value?: string | number | boolean | null;
+  /** Filter operation defines the operations which can be used when filtering on a
+  query endpoint.
+
+  On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
+   */
+  operation: QueryUsersBodyFilterItemOperation;
+};

package/src/generated/model/queryUsersBodyFilterItemField.ts

@@ -0,0 +1,48 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Field to filter users by:
+- `created_at`: RFC3339 timestamp
+- `id`: user id
+- `schema`: the schema the user's attributes satisfy, matched against the
+  value the user carries as `schema`
+- `status`: one of `active`, `suspended`, `deactivated`, `pending_purge`
+- `team_id`: restricts the result to users holding an **active** membership
+  in that team. A user who has been invited but has not accepted does not
+  match. `equals` is the only operation, and the field may be given once —
+  this names one team, not a set.
+- `lifecycle_owner_team_id`: the team that owns the user's identity
+  lifecycle. The column is nullable for self-owned users, and a null filter
+  value is rejected, so self-owned users cannot be selected by this field.
+
+**The two team fields answer different questions.** `team_id` is membership:
+which team the user collaborates in, readable per user at
+`GET /users/{user_id}/teams`. `lifecycle_owner_team_id` is ownership: which
+team may deprovision the user. A user can belong to many teams while owning
+their own lifecycle, so the two disagree often and neither implies the other
+(ADR 024).
+
+`team_id` is filterable but not sortable — it is not a column on the user, so
+it is absent from the sort-field enum.
+
+Filtering on `team_id` requires `team_membership.read` in addition to
+`user.read`: it reads the same memberships that `expand: ["teams"]` embeds.
+
+ */
+export type QueryUsersBodyFilterItemField =
+  (typeof QueryUsersBodyFilterItemField)[keyof typeof QueryUsersBodyFilterItemField];
+
+export const QueryUsersBodyFilterItemField = {
+  created_at: "created_at",
+  id: "id",
+  schema: "schema",
+  status: "status",
+  team_id: "team_id",
+  lifecycle_owner_team_id: "lifecycle_owner_team_id",
+} as const;

package/src/generated/model/queryUsersBodyFilterItemOperation.ts

@@ -0,0 +1,30 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Filter operation defines the operations which can be used when filtering on a
+query endpoint.
+
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
+ */
+export type QueryUsersBodyFilterItemOperation =
+  (typeof QueryUsersBodyFilterItemOperation)[keyof typeof QueryUsersBodyFilterItemOperation];
+
+export const QueryUsersBodyFilterItemOperation = {
+  equals: "equals",
+  not_equals: "not_equals",
+  contains: "contains",
+  not_contains: "not_contains",
+  less_than: "less_than",
+  less_than_or_equal: "less_than_or_equal",
+  greater_than: "greater_than",
+  greater_than_or_equal: "greater_than_or_equal",
+} as const;

package/src/generated/model/queryUsersBodySorting.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryUsersBodySortingDirection } from "./queryUsersBodySortingDirection";
+import type { QueryUsersBodySortingField } from "./queryUsersBodySortingField";
+
+export type QueryUsersBodySorting = {
+  /** Field to sort users by. Only stored columns are sortable: the keyset cursor
+  holds the last row's sort values, so a value computed per request would skip
+  or duplicate rows between pages.
+
+  Sorting by `lifecycle_owner_team_id` groups self-owned users together, since
+  the column is null for them.
+   */
+  field: QueryUsersBodySortingField;
+  direction: QueryUsersBodySortingDirection;
+};

package/src/generated/model/queryUsersBodySortingDirection.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type QueryUsersBodySortingDirection =
+  (typeof QueryUsersBodySortingDirection)[keyof typeof QueryUsersBodySortingDirection];
+
+export const QueryUsersBodySortingDirection = {
+  asc: "asc",
+  desc: "desc",
+} as const;

package/src/generated/model/queryUsersBodySortingField.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Field to sort users by. Only stored columns are sortable: the keyset cursor
+holds the last row's sort values, so a value computed per request would skip
+or duplicate rows between pages.
+
+Sorting by `lifecycle_owner_team_id` groups self-owned users together, since
+the column is null for them.
+
+ */
+export type QueryUsersBodySortingField =
+  (typeof QueryUsersBodySortingField)[keyof typeof QueryUsersBodySortingField];
+
+export const QueryUsersBodySortingField = {
+  created_at: "created_at",
+  id: "id",
+  schema: "schema",
+  status: "status",
+  lifecycle_owner_team_id: "lifecycle_owner_team_id",
+} as const;

package/src/generated/model/queryUsersDefault.ts

@@ -0,0 +1,69 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type QueryUsersDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "not_implemented";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.permission_denied";
+    });

package/src/generated/model/revokeMySession401.ts

@@ -5,10 +5,12 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { RevokeMySession401Details } from "./revokeMySession401Details";
 
 /**
- * Standard error payload returned for failed API requests.
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
  */
 export type RevokeMySession401 = {
   /** Stable machine-readable error code. */
@@ -16,5 +18,7 @@ export type RevokeMySession401 = {
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: RevokeMySession401Details;
+  details?: { [key: string]: unknown };
+} & {
+  code: "auth.unauthorized";
 };