@zitadel/api 1.0.0-alpha.21 → 1.0.0-alpha.22

package/src/generated/model/queryGrants200GrantsItemPrincipal.ts

@@ -0,0 +1,147 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
+ */
+export type QueryGrants200GrantsItemPrincipal =
+  | {
+      /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+      id: string;
+      /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+      schema: string;
+      /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+      attributes: { [key: string]: unknown };
+      metadata: {
+        /** The time when the user was created. */
+        created_at: string;
+        /** The time when the user was last updated. */
+        updated_at: string;
+        /** The status of the user. */
+        status: "active" | "suspended" | "deactivated" | "pending_purge";
+        /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team memberships: it decides who may deprovision the user, not
+  which teams the user collaborates in. Memberships are their own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+        lifecycle_owner_team_id?: string | null;
+        /** The team named by `lifecycle_owner_team_id`, present only when the
+  request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+  Absent means it was not requested; `null` means the user is self-owned
+  and there is no owner to resolve.
+
+  Requesting it does not guarantee it is present on every user. Today
+  `team.read` is checked once for the whole request, so it is; once that
+  check is per team, a page may contain a user whose owner the caller may
+  not read, and such a row answers with neither the team nor `null` —
+  `null` already means self-owned. What it answers with instead is decided
+  with the granular scopes (#420); do not read the two cases above as the
+  complete set.
+
+  This is the same representation `GET /teams/{team_id}` serves. It is a
+  single team, not a collection, so it carries no cap and no truncation
+  flag.
+   */
+        readonly lifecycle_owner_team?: {
+          /** The unique identifier of the team. */
+          id: string;
+          /** The name of the team. */
+          name: string;
+          /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+          status: "active" | "deactivated";
+          /** The time when the team was created. */
+          created_at: string;
+          /** The time when the team was last updated. */
+          updated_at: string;
+        } | null;
+      };
+      /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+      readonly identifier?: string;
+      /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+      readonly identifier_property?: string;
+      /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+      readonly display?: string;
+      /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+   */
+      readonly teams?: readonly {
+        /** The unique identifier of the team. */
+        id: string;
+        /** The name of the team. */
+        name: string;
+        /** The user's participation state on this team. Memberships the user was
+  removed from are not returned.
+   */
+        membership_status: "pending" | "active" | "inactive";
+        /** The time when the user joined this team. */
+        created_at: string;
+        /** The time when this membership was last changed. */
+        updated_at: string;
+      }[];
+      /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+   */
+      readonly teams_truncated?: boolean;
+    }
+  | {
+      /** The unique identifier of the team. */
+      id: string;
+      /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+      status: "active" | "deactivated";
+      /** The time when the team was created. */
+      created_at: string;
+      /** The time when the team was last updated. */
+      updated_at: string;
+    }
+  | null;

package/src/generated/model/queryGrants200GrantsItemPrincipalType.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Kind of principal bound by this grant.
+ */
+export type QueryGrants200GrantsItemPrincipalType =
+  (typeof QueryGrants200GrantsItemPrincipalType)[keyof typeof QueryGrants200GrantsItemPrincipalType];
+
+export const QueryGrants200GrantsItemPrincipalType = {
+  user: "user",
+  team: "team",
+} as const;

package/src/generated/model/queryGrants200GrantsItemRelation.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Catalog relation on the project.
+ */
+export type QueryGrants200GrantsItemRelation =
+  (typeof QueryGrants200GrantsItemRelation)[keyof typeof QueryGrants200GrantsItemRelation];
+
+export const QueryGrants200GrantsItemRelation = {
+  viewer: "viewer",
+  editor: "editor",
+  admin: "admin",
+} as const;

package/src/generated/model/queryGrants200GrantsItemTeam.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+export type QueryGrants200GrantsItemTeam = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */
+  team_id: string;
+  /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+};

package/src/generated/model/queryGrants200GrantsItemUser.ts

@@ -0,0 +1,38 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+export type QueryGrants200GrantsItemUser = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/queryGrants400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrants400Details } from "./queryGrants400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryGrants400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryGrants400Details;
+};

package/src/generated/model/queryGrants400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryGrants400Details = { [key: string]: unknown };

package/src/generated/model/queryGrants401.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrants401Details } from "./queryGrants401Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryGrants401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryGrants401Details;
+};

package/src/generated/model/queryGrants401Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryGrants401Details = { [key: string]: unknown };

package/src/generated/model/queryGrants403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrants403Details } from "./queryGrants403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type QueryGrants403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: QueryGrants403Details;
+};

package/src/generated/model/queryGrants403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type QueryGrants403Details = { [key: string]: unknown };

package/src/generated/model/queryGrantsBody.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrantsBodyExpandItem } from "./queryGrantsBodyExpandItem";
+import type { QueryGrantsBodyFilterItem } from "./queryGrantsBodyFilterItem";
+import type { QueryGrantsBodySorting } from "./queryGrantsBodySorting";
+
+/**
+ * Request to query the grants of a project.
+ */
+export type QueryGrantsBody = {
+  /**
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /** Token to retrieve the next page of results. Must be sent with the same
+  `sorting` as the request that issued the token. Omitting `sorting` reuses
+  the default sort and only succeeds when that default matches the token.
+   */
+  page_token?: string | null;
+  /** Related objects to embed on each grant (ADR 059). Omit it and no
+  embedded object is returned. An unrecognised value is rejected.
+   */
+  expand?: QueryGrantsBodyExpandItem[];
+  sorting?: QueryGrantsBodySorting;
+  /** Filter criteria for querying grants. Combined with AND. */
+  filter?: QueryGrantsBodyFilterItem[];
+};

package/src/generated/model/queryGrantsBodyExpandItem.ts

@@ -0,0 +1,30 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A related object to embed on each returned grant (ADR 059).
+
+- `principal`: the principal named by `principal_id`, as `principal` on
+  each grant. The property is omitted entirely when not requested. When
+  requested, it is the same body `GET /users/{id}` serves for
+  `principal_type=user`, or `GET /teams/{id}` for `principal_type=team`,
+  and `null` when that principal cannot be loaded. Discriminate with the
+  grant's existing `principal_type`.
+
+  Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list, because a mixed
+  page is the common case. A caller who may not read either resource
+  receives 403 rather than a silently missing `principal`.
+
+ */
+export type QueryGrantsBodyExpandItem =
+  (typeof QueryGrantsBodyExpandItem)[keyof typeof QueryGrantsBodyExpandItem];
+
+export const QueryGrantsBodyExpandItem = {
+  principal: "principal",
+} as const;

package/src/generated/model/queryGrantsBodyFilterItem.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrantsBodyFilterItemField } from "./queryGrantsBodyFilterItemField";
+import type { QueryGrantsBodyFilterItemOperation } from "./queryGrantsBodyFilterItemOperation";
+
+export type QueryGrantsBodyFilterItem = {
+  /** Field to filter grants by:
+  - `created_at`: RFC3339 timestamp
+  - `principal_type`: `user` or `team`
+  - `principal_id`: principal id (`user_<opaque>` or `team_<opaque>`)
+  - `relation`: `viewer`, `editor`, or `admin`
+  - `expires_at`: RFC3339 timestamp (null when the grant does not expire)
+   */
+  field: QueryGrantsBodyFilterItemField;
+  /** Filter-value specifies which values can be filtered by a query endpoint. This
+  is a union of types. When a value is specified which is not assignable to the
+  field which is being filtered, a 400 error will be returned.
+   */
+  value?: string | number | boolean | null;
+  /** Filter operation defines the operations which can be used when filtering on a
+  query endpoint.
+
+  On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
+   */
+  operation: QueryGrantsBodyFilterItemOperation;
+};

package/src/generated/model/queryGrantsBodyFilterItemField.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Field to filter grants by:
+- `created_at`: RFC3339 timestamp
+- `principal_type`: `user` or `team`
+- `principal_id`: principal id (`user_<opaque>` or `team_<opaque>`)
+- `relation`: `viewer`, `editor`, or `admin`
+- `expires_at`: RFC3339 timestamp (null when the grant does not expire)
+
+ */
+export type QueryGrantsBodyFilterItemField =
+  (typeof QueryGrantsBodyFilterItemField)[keyof typeof QueryGrantsBodyFilterItemField];
+
+export const QueryGrantsBodyFilterItemField = {
+  created_at: "created_at",
+  principal_type: "principal_type",
+  principal_id: "principal_id",
+  relation: "relation",
+  expires_at: "expires_at",
+} as const;

package/src/generated/model/queryGrantsBodyFilterItemOperation.ts

@@ -0,0 +1,30 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Filter operation defines the operations which can be used when filtering on a
+query endpoint.
+
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
+ */
+export type QueryGrantsBodyFilterItemOperation =
+  (typeof QueryGrantsBodyFilterItemOperation)[keyof typeof QueryGrantsBodyFilterItemOperation];
+
+export const QueryGrantsBodyFilterItemOperation = {
+  equals: "equals",
+  not_equals: "not_equals",
+  contains: "contains",
+  not_contains: "not_contains",
+  less_than: "less_than",
+  less_than_or_equal: "less_than_or_equal",
+  greater_than: "greater_than",
+  greater_than_or_equal: "greater_than_or_equal",
+} as const;

package/src/generated/model/queryGrantsBodySorting.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { QueryGrantsBodySortingDirection } from "./queryGrantsBodySortingDirection";
+import type { QueryGrantsBodySortingField } from "./queryGrantsBodySortingField";
+
+export type QueryGrantsBodySorting = {
+  /** Field to sort grants by. Default is `created_at` ascending with `id` as
+  the tiebreaker.
+   */
+  field: QueryGrantsBodySortingField;
+  direction: QueryGrantsBodySortingDirection;
+};

package/src/generated/model/queryGrantsBodySortingDirection.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type QueryGrantsBodySortingDirection =
+  (typeof QueryGrantsBodySortingDirection)[keyof typeof QueryGrantsBodySortingDirection];
+
+export const QueryGrantsBodySortingDirection = {
+  asc: "asc",
+  desc: "desc",
+} as const;

package/src/generated/model/queryGrantsBodySortingField.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Field to sort grants by. Default is `created_at` ascending with `id` as
+the tiebreaker.
+
+ */
+export type QueryGrantsBodySortingField =
+  (typeof QueryGrantsBodySortingField)[keyof typeof QueryGrantsBodySortingField];
+
+export const QueryGrantsBodySortingField = {
+  created_at: "created_at",
+  expires_at: "expires_at",
+  id: "id",
+} as const;

package/src/generated/model/queryGrantsDefault.ts

@@ -0,0 +1,99 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type QueryGrantsDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "grant.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "grant.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "grant.permission_denied";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "not_implemented";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "team.permission_denied";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.permission_denied";
+    });