@zitadel/api 1.0.0-alpha.21 → 1.0.0-alpha.22

package/src/generated/model/completeClaim410.ts

@@ -6,19 +6,24 @@
  * OpenAPI spec version: 0.0.1
  */
 
-/**
- * The claim challenge has expired
-
-Error code: proj.claim_expired
-
- */
-export type CompleteClaim410 = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: { [key: string]: unknown };
-} & {
-  code: "proj.claim_expired";
-};
+export type CompleteClaim410 =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "proj.claim_expired";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "proj.claim_window_expired";
+    });

package/src/generated/model/createFlowDefinition201FlowDefinition.ts

@@ -23,9 +23,11 @@ the purpose + audience when a flow is created via POST /flow.
 export type CreateFlowDefinition201FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
 
      * @pattern ^[a-z][a-z0-9-]*$
      */

package/src/generated/model/createFlowDefinitionBodyFlowDefinition.ts

@@ -23,9 +23,11 @@ the purpose + audience when a flow is created via POST /flow.
 export type CreateFlowDefinitionBodyFlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
 
      * @pattern ^[a-z][a-z0-9-]*$
      */

package/src/generated/model/createFlowDefinitionDefault.ts

@@ -27,16 +27,6 @@ export type CreateFlowDefinitionDefault =
     } & {
       code: "evt.invalid";
     })
-  | ({
-      /** Stable machine-readable error code. */
-      code: string;
-      /** Human-readable explanation of the error. */
-      message: string;
-      /** Additional error-specific context. */
-      details?: { [key: string]: unknown };
-    } & {
-      code: "flowdef.already_exists";
-    })
   | ({
       /** Stable machine-readable error code. */
       code: string;

package/src/generated/model/createGrant201.ts

@@ -6,8 +6,11 @@
  * OpenAPI spec version: 0.0.1
  */
 import type { CreateGrant201ObjectType } from "./createGrant201ObjectType";
+import type { CreateGrant201Principal } from "./createGrant201Principal";
 import type { CreateGrant201PrincipalType } from "./createGrant201PrincipalType";
 import type { CreateGrant201Relation } from "./createGrant201Relation";
+import type { CreateGrant201Team } from "./createGrant201Team";
+import type { CreateGrant201User } from "./createGrant201User";
 
 /**
  * A collaboration grant binding a principal to a project relation.
@@ -31,4 +34,33 @@ export type CreateGrant201 = {
   returns expired unrevoked grants; authorization ignores them.
    */
   expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: CreateGrant201User;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: CreateGrant201Team;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+
+  When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+
+  Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: CreateGrant201Principal;
 };

package/src/generated/model/createGrant201Principal.ts

@@ -0,0 +1,147 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
+ */
+export type CreateGrant201Principal =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      id: string;
+      /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+      schema: string;
+      /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+      attributes: { [key: string]: unknown };
+      metadata: {
+        /** The time when the user was created. */
+        created_at: string;
+        /** The time when the user was last updated. */
+        updated_at: string;
+        /** The status of the user. */
+        status: "active" | "suspended" | "deactivated" | "pending_purge";
+        /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team memberships: it decides who may deprovision the user, not
+  which teams the user collaborates in. Memberships are their own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+        lifecycle_owner_team_id?: string | null;
+        /** The team named by `lifecycle_owner_team_id`, present only when the
+  request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+  Absent means it was not requested; `null` means the user is self-owned
+  and there is no owner to resolve.
+
+  Requesting it does not guarantee it is present on every user. Today
+  `team.read` is checked once for the whole request, so it is; once that
+  check is per team, a page may contain a user whose owner the caller may
+  not read, and such a row answers with neither the team nor `null` —
+  `null` already means self-owned. What it answers with instead is decided
+  with the granular scopes (#420); do not read the two cases above as the
+  complete set.
+
+  This is the same representation `GET /teams/{team_id}` serves. It is a
+  single team, not a collection, so it carries no cap and no truncation
+  flag.
+   */
+        readonly lifecycle_owner_team?: {
+          /** The unique identifier of the team. */
+          id: string;
+          /** The name of the team. */
+          name: string;
+          /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+          status: "active" | "deactivated";
+          /** The time when the team was created. */
+          created_at: string;
+          /** The time when the team was last updated. */
+          updated_at: string;
+        } | null;
+      };
+      /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+      readonly identifier?: string;
+      /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+      readonly identifier_property?: string;
+      /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+      readonly display?: string;
+      /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+   */
+      readonly teams?: readonly {
+        /** The unique identifier of the team. */
+        id: string;
+        /** The name of the team. */
+        name: string;
+        /** The user's participation state on this team. Memberships the user was
+  removed from are not returned.
+   */
+        membership_status: "pending" | "active" | "inactive";
+        /** The time when the user joined this team. */
+        created_at: string;
+        /** The time when this membership was last changed. */
+        updated_at: string;
+      }[];
+      /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+   */
+      readonly teams_truncated?: boolean;
+    }
+  | {
+      /** The unique identifier of the team. */
+      id: string;
+      /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+      status: "active" | "deactivated";
+      /** The time when the team was created. */
+      created_at: string;
+      /** The time when the team was last updated. */
+      updated_at: string;
+    }
+  | null;

package/src/generated/model/createGrant201Team.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+export type CreateGrant201Team = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */
+  team_id: string;
+  /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+};

package/src/generated/model/createGrant201User.ts

@@ -0,0 +1,38 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+export type CreateGrant201User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/createSession201Session.ts

@@ -43,6 +43,7 @@ export type CreateSession201Session = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: CreateSession201SessionUser;
   /** Verified authentication factors accumulated by this session.

package/src/generated/model/createSession201SessionUser.ts

@@ -12,6 +12,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 export type CreateSession201SessionUser = {

package/src/generated/model/exchangeHandoff200Session.ts

@@ -43,6 +43,7 @@ export type ExchangeHandoff200Session = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: ExchangeHandoff200SessionUser;
   /** Verified authentication factors accumulated by this session.

package/src/generated/model/exchangeHandoff200SessionUser.ts

@@ -12,6 +12,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 export type ExchangeHandoff200SessionUser = {

package/src/generated/model/getClaimStatus410.ts

@@ -6,19 +6,24 @@
  * OpenAPI spec version: 0.0.1
  */
 
-/**
- * The claim challenge has expired
-
-Error code: proj.claim_expired
-
- */
-export type GetClaimStatus410 = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: { [key: string]: unknown };
-} & {
-  code: "proj.claim_expired";
-};
+export type GetClaimStatus410 =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "proj.claim_expired";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "proj.claim_window_expired";
+    });

package/src/generated/model/getClaimWindow200.ts

@@ -0,0 +1,23 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * How long the project can still be claimed. Derived from the project's
+creation time and the fixed 14-day claim window (ADR 046); it does not
+depend on the challenge, which has its own much shorter expiry.
+
+ */
+export type GetClaimWindow200 = {
+  /** The time when the project's claim window closes. */
+  expires_at: string;
+  /** Whether the window has already closed. Reported alongside `expires_at`
+  rather than left to the client so a skewed browser clock cannot show a
+  claimable project as expired, or the reverse.
+   */
+  expired: boolean;
+};

package/src/generated/model/{createFlowDefinition409.ts → getClaimWindow404.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { CreateFlowDefinition409Details } from "./createFlowDefinition409Details";
+import type { GetClaimWindow404Details } from "./getClaimWindow404Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type CreateFlowDefinition409 = {
+export type GetClaimWindow404 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: CreateFlowDefinition409Details;
+  details?: GetClaimWindow404Details;
 };

package/src/generated/model/{createFlowDefinition409Details.ts → getClaimWindow404Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type CreateFlowDefinition409Details = { [key: string]: unknown };
+export type GetClaimWindow404Details = { [key: string]: unknown };

package/src/generated/model/getClaimWindow429.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetClaimWindow429Details } from "./getClaimWindow429Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetClaimWindow429 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetClaimWindow429Details;
+};

package/src/generated/model/getClaimWindow429Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetClaimWindow429Details = { [key: string]: unknown };

package/src/generated/model/getClaimWindowDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { GetClaimWindowDefaultDetails } from "./getClaimWindowDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type GetClaimWindowDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: GetClaimWindowDefaultDetails;
+};

package/src/generated/model/getClaimWindowDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type GetClaimWindowDefaultDetails = { [key: string]: unknown };

package/src/generated/model/getClaimWindowParams.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type GetClaimWindowParams = {
+  /**
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+};

package/src/generated/model/getEvent200.ts

@@ -1251,6 +1251,81 @@ export type GetEvent200 =
       flow_id?: string | null;
       /** Emit-time metadata, already redacted at write. Path A request.api may
   set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "release.created";
+      /** Allowlisted fields for `release.created`. The release id is already the
+  event's `entity_id`; the pinned set is repeated here so the audit stream
+  answers what a release contained without reading the release itself.
+   */
+      payload: {
+        content_hash?: string;
+        message?: string;
+        git_sha?: string;
+        git_dirty?: boolean;
+        pointers?: {
+          kind?: string;
+          handle?: string;
+          revision_id?: string;
+        }[];
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
   live risk-evaluator input.
    */
       metadata?: {