@zitadel/api 1.0.0-alpha.21 → 1.0.0-alpha.22

package/src/generated/model/getFlowDefinition200FlowDefinition.ts

@@ -23,9 +23,11 @@ the purpose + audience when a flow is created via POST /flow.
 export type GetFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
 
      * @pattern ^[a-z][a-z0-9-]*$
      */

package/src/generated/model/getGrant200.ts

@@ -6,8 +6,11 @@
  * OpenAPI spec version: 0.0.1
  */
 import type { GetGrant200ObjectType } from "./getGrant200ObjectType";
+import type { GetGrant200Principal } from "./getGrant200Principal";
 import type { GetGrant200PrincipalType } from "./getGrant200PrincipalType";
 import type { GetGrant200Relation } from "./getGrant200Relation";
+import type { GetGrant200Team } from "./getGrant200Team";
+import type { GetGrant200User } from "./getGrant200User";
 
 /**
  * A collaboration grant binding a principal to a project relation.
@@ -31,4 +34,33 @@ export type GetGrant200 = {
   returns expired unrevoked grants; authorization ignores them.
    */
   expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: GetGrant200User;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: GetGrant200Team;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+
+  When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+
+  Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: GetGrant200Principal;
 };

package/src/generated/model/getGrant200Principal.ts

@@ -0,0 +1,147 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
+ */
+export type GetGrant200Principal =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      id: string;
+      /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+      schema: string;
+      /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+      attributes: { [key: string]: unknown };
+      metadata: {
+        /** The time when the user was created. */
+        created_at: string;
+        /** The time when the user was last updated. */
+        updated_at: string;
+        /** The status of the user. */
+        status: "active" | "suspended" | "deactivated" | "pending_purge";
+        /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team memberships: it decides who may deprovision the user, not
+  which teams the user collaborates in. Memberships are their own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+        lifecycle_owner_team_id?: string | null;
+        /** The team named by `lifecycle_owner_team_id`, present only when the
+  request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+  Absent means it was not requested; `null` means the user is self-owned
+  and there is no owner to resolve.
+
+  Requesting it does not guarantee it is present on every user. Today
+  `team.read` is checked once for the whole request, so it is; once that
+  check is per team, a page may contain a user whose owner the caller may
+  not read, and such a row answers with neither the team nor `null` —
+  `null` already means self-owned. What it answers with instead is decided
+  with the granular scopes (#420); do not read the two cases above as the
+  complete set.
+
+  This is the same representation `GET /teams/{team_id}` serves. It is a
+  single team, not a collection, so it carries no cap and no truncation
+  flag.
+   */
+        readonly lifecycle_owner_team?: {
+          /** The unique identifier of the team. */
+          id: string;
+          /** The name of the team. */
+          name: string;
+          /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+          status: "active" | "deactivated";
+          /** The time when the team was created. */
+          created_at: string;
+          /** The time when the team was last updated. */
+          updated_at: string;
+        } | null;
+      };
+      /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+      readonly identifier?: string;
+      /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+      readonly identifier_property?: string;
+      /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+      readonly display?: string;
+      /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+   */
+      readonly teams?: readonly {
+        /** The unique identifier of the team. */
+        id: string;
+        /** The name of the team. */
+        name: string;
+        /** The user's participation state on this team. Memberships the user was
+  removed from are not returned.
+   */
+        membership_status: "pending" | "active" | "inactive";
+        /** The time when the user joined this team. */
+        created_at: string;
+        /** The time when this membership was last changed. */
+        updated_at: string;
+      }[];
+      /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+   */
+      readonly teams_truncated?: boolean;
+    }
+  | {
+      /** The unique identifier of the team. */
+      id: string;
+      /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+      status: "active" | "deactivated";
+      /** The time when the team was created. */
+      created_at: string;
+      /** The time when the team was last updated. */
+      updated_at: string;
+    }
+  | null;

package/src/generated/model/getGrant200Team.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+export type GetGrant200Team = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */
+  team_id: string;
+  /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+};

package/src/generated/model/getGrant200User.ts

@@ -0,0 +1,38 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+export type GetGrant200User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/getMySession200.ts

@@ -43,6 +43,7 @@ export type GetMySession200 = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: GetMySession200User;
   /** Verified authentication factors accumulated by this session.

package/src/generated/model/getMySession200User.ts

@@ -12,6 +12,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 export type GetMySession200User = {

package/src/generated/model/getSession200.ts

@@ -43,6 +43,7 @@ export type GetSession200 = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: GetSession200User;
   /** Verified authentication factors accumulated by this session.

package/src/generated/model/getSession200User.ts

@@ -12,6 +12,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 export type GetSession200User = {

package/src/generated/model/index.ts

@@ -99,8 +99,6 @@ export * from "./createFlowDefinition201FlowDefinitionStepsItemTransitions";
 export * from "./createFlowDefinition201UserSchema";
 export * from "./createFlowDefinition400";
 export * from "./createFlowDefinition400Details";
-export * from "./createFlowDefinition409";
-export * from "./createFlowDefinition409Details";
 export * from "./createFlowDefinitionBody";
 export * from "./createFlowDefinitionBodyFlowDefinition";
 export * from "./createFlowDefinitionBodyFlowDefinitionAudience";
@@ -118,8 +116,11 @@ export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemTransitions";
 export * from "./createFlowDefinitionDefault";
 export * from "./createGrant201";
 export * from "./createGrant201ObjectType";
+export * from "./createGrant201Principal";
 export * from "./createGrant201PrincipalType";
 export * from "./createGrant201Relation";
+export * from "./createGrant201Team";
+export * from "./createGrant201User";
 export * from "./createGrant400";
 export * from "./createGrant400Details";
 export * from "./createGrant401";
@@ -305,6 +306,14 @@ export * from "./getClaimStatus429Details";
 export * from "./getClaimStatusDefault";
 export * from "./getClaimStatusDefaultDetails";
 export * from "./getClaimStatusParams";
+export * from "./getClaimWindow200";
+export * from "./getClaimWindow404";
+export * from "./getClaimWindow404Details";
+export * from "./getClaimWindow429";
+export * from "./getClaimWindow429Details";
+export * from "./getClaimWindowDefault";
+export * from "./getClaimWindowDefaultDetails";
+export * from "./getClaimWindowParams";
 export * from "./getEnvironmentByName200";
 export * from "./getEnvironmentByNameDefault";
 export * from "./getEnvironmentByNameParams";
@@ -360,8 +369,11 @@ export * from "./getFlowStep410Details";
 export * from "./getFlowStepDefault";
 export * from "./getGrant200";
 export * from "./getGrant200ObjectType";
+export * from "./getGrant200Principal";
 export * from "./getGrant200PrincipalType";
 export * from "./getGrant200Relation";
+export * from "./getGrant200Team";
+export * from "./getGrant200User";
 export * from "./getGrant401";
 export * from "./getGrant401Details";
 export * from "./getGrant403";
@@ -468,6 +480,7 @@ export * from "./initClaim401Details";
 export * from "./initClaim404";
 export * from "./initClaim409";
 export * from "./initClaim409Details";
+export * from "./initClaim410";
 export * from "./initClaimDefault";
 export * from "./initClaimDefaultDetails";
 export * from "./issueChallenge201";
@@ -574,6 +587,30 @@ export * from "./patchProject404";
 export * from "./patchProject404Details";
 export * from "./patchProjectBody";
 export * from "./patchProjectDefault";
+export * from "./queryGrants200";
+export * from "./queryGrants200GrantsItem";
+export * from "./queryGrants200GrantsItemObjectType";
+export * from "./queryGrants200GrantsItemPrincipal";
+export * from "./queryGrants200GrantsItemPrincipalType";
+export * from "./queryGrants200GrantsItemRelation";
+export * from "./queryGrants200GrantsItemTeam";
+export * from "./queryGrants200GrantsItemUser";
+export * from "./queryGrants400";
+export * from "./queryGrants400Details";
+export * from "./queryGrants401";
+export * from "./queryGrants401Details";
+export * from "./queryGrants403";
+export * from "./queryGrants403Details";
+export * from "./queryGrantsBody";
+export * from "./queryGrantsBodyExpandItem";
+export * from "./queryGrantsBodyFilterItem";
+export * from "./queryGrantsBodyFilterItemField";
+export * from "./queryGrantsBodyFilterItemOperation";
+export * from "./queryGrantsBodySorting";
+export * from "./queryGrantsBodySortingDirection";
+export * from "./queryGrantsBodySortingField";
+export * from "./queryGrantsDefault";
+export * from "./queryGrantsParams";
 export * from "./queryProjects200";
 export * from "./queryProjects200ProjectsItem";
 export * from "./queryProjects400";

package/src/generated/model/initClaim410.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The project was not claimed within 14 days of creation and can no longer be claimed
+
+Error code: proj.claim_window_expired
+
+ */
+export type InitClaim410 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: { [key: string]: unknown };
+} & {
+  code: "proj.claim_window_expired";
+};

package/src/generated/model/listEvents200DataItem.ts

@@ -1251,6 +1251,81 @@ export type ListEvents200DataItem =
       flow_id?: string | null;
       /** Emit-time metadata, already redacted at write. Path A request.api may
   set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "release.created";
+      /** Allowlisted fields for `release.created`. The release id is already the
+  event's `entity_id`; the pinned set is repeated here so the audit stream
+  answers what a release contained without reading the release itself.
+   */
+      payload: {
+        content_hash?: string;
+        message?: string;
+        git_sha?: string;
+        git_dirty?: boolean;
+        pointers?: {
+          kind?: string;
+          handle?: string;
+          revision_id?: string;
+        }[];
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
   live risk-evaluator input.
    */
       metadata?: {

package/src/generated/model/listFlowDefinitions200.ts

@@ -7,6 +7,9 @@
  */
 import type { ListFlowDefinitions200FlowDefinitionsItem } from "./listFlowDefinitions200FlowDefinitionsItem";
 
+/**
+ * List of flow definitions, newest by creation time first.
+ */
 export type ListFlowDefinitions200 = {
   flow_definitions: ListFlowDefinitions200FlowDefinitionsItem[];
   /** The token to retrieve the next page of results. Absent if there are no more results. */

package/src/generated/model/listFlowDefinitions200FlowDefinitionsItemFlowDefinition.ts

@@ -23,9 +23,11 @@ the purpose + audience when a flow is created via POST /flow.
 export type ListFlowDefinitions200FlowDefinitionsItemFlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
 
      * @pattern ^[a-z][a-z0-9-]*$
      */

package/src/generated/model/listFlowDefinitionsParams.ts

@@ -32,6 +32,14 @@ Its format is opaque and may change between releases.
    * Filter flow definitions by purpose (e.g., registration, login).
    */
   purpose?: ListFlowDefinitionsPurpose;
+  /**
+ * The flow name to filter by. Every revision of a flow shares its
+`name`, so the result is that flow's revisions, newest by creation
+time first.
+
+ * @pattern ^[a-z][a-z0-9-]*$
+ */
+  name?: string;
   /**
    * Related entities to embed on each returned flow definition.
    */

package/src/generated/model/queryGrants200.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrants200GrantsItem } from "./queryGrants200GrantsItem";
+
+/**
+ * Paginated list of grants.
+ */
+export type QueryGrants200 = {
+  grants: QueryGrants200GrantsItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results. The follow-up request must repeat the
+  same `sorting` that produced this token (omit only when both pages use the default).
+   */
+  next_page_token?: string | null;
+};

package/src/generated/model/queryGrants200GrantsItem.ts

@@ -0,0 +1,66 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrants200GrantsItemObjectType } from "./queryGrants200GrantsItemObjectType";
+import type { QueryGrants200GrantsItemPrincipal } from "./queryGrants200GrantsItemPrincipal";
+import type { QueryGrants200GrantsItemPrincipalType } from "./queryGrants200GrantsItemPrincipalType";
+import type { QueryGrants200GrantsItemRelation } from "./queryGrants200GrantsItemRelation";
+import type { QueryGrants200GrantsItemTeam } from "./queryGrants200GrantsItemTeam";
+import type { QueryGrants200GrantsItemUser } from "./queryGrants200GrantsItemUser";
+
+/**
+ * A collaboration grant binding a principal to a project relation.
+ */
+export type QueryGrants200GrantsItem = {
+  /** Managed assignment id (`asgn_<opaque>`). */
+  id: string;
+  /** Project this grant is scoped to. */
+  project_id: string;
+  /** Kind of principal bound by this grant. */
+  principal_type: QueryGrants200GrantsItemPrincipalType;
+  /** Principal id (`user_<opaque>` or `team_<opaque>`). */
+  principal_id: string;
+  /** Catalog object type. Always `project` for this API. */
+  object_type: QueryGrants200GrantsItemObjectType;
+  /** Catalog relation on the project. */
+  relation: QueryGrants200GrantsItemRelation;
+  /** When the grant was created. */
+  created_at: string;
+  /** When the grant expires. Null when it does not expire. GET still
+  returns expired unrevoked grants; authorization ignores them.
+   */
+  expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: QueryGrants200GrantsItemUser;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: QueryGrants200GrantsItemTeam;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+
+  When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+
+  Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: QueryGrants200GrantsItemPrincipal;
+};

package/src/generated/model/queryGrants200GrantsItemObjectType.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Catalog object type. Always `project` for this API.
+ */
+export type QueryGrants200GrantsItemObjectType =
+  (typeof QueryGrants200GrantsItemObjectType)[keyof typeof QueryGrants200GrantsItemObjectType];
+
+export const QueryGrants200GrantsItemObjectType = {
+  project: "project",
+} as const;