@zyphr-dev/node-sdk 0.1.36 → 0.1.38

package/src/src/apis/AuthUserDirectoryApi.ts

@@ -0,0 +1,596 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  InviteEndUserRequest,
+  SetEndUserClaimsRequest,
+  UpdateEndUserByApplicationRequest,
+} from '../models/index';
+import {
+    InviteEndUserRequestFromJSON,
+    InviteEndUserRequestToJSON,
+    SetEndUserClaimsRequestFromJSON,
+    SetEndUserClaimsRequestToJSON,
+    UpdateEndUserByApplicationRequestFromJSON,
+    UpdateEndUserByApplicationRequestToJSON,
+} from '../models/index';
+
+export interface AuthUserDirectoryApiDeleteEndUserByApplicationRequest {
+    userId: string;
+}
+
+export interface AuthUserDirectoryApiGetEndUserByEmailRequest {
+    email: string;
+}
+
+export interface AuthUserDirectoryApiGetEndUserByIdRequest {
+    userId: string;
+}
+
+export interface AuthUserDirectoryApiGetEndUserClaimsRequest {
+    userId: string;
+}
+
+export interface AuthUserDirectoryApiInviteEndUserOperationRequest {
+    inviteEndUserRequest: InviteEndUserRequest;
+}
+
+export interface AuthUserDirectoryApiListEndUsersRequest {
+    page?: number;
+    perPage?: number;
+    search?: string;
+    environment?: ListEndUsersEnvironmentEnum;
+}
+
+export interface AuthUserDirectoryApiSetEndUserClaimsOperationRequest {
+    userId: string;
+    setEndUserClaimsRequest: SetEndUserClaimsRequest;
+}
+
+export interface AuthUserDirectoryApiUpdateEndUserByApplicationOperationRequest {
+    userId: string;
+    updateEndUserByApplicationRequest: UpdateEndUserByApplicationRequest;
+}
+
+/**
+ * AuthUserDirectoryApi - interface
+ * 
+ * @export
+ * @interface AuthUserDirectoryApiInterface
+ */
+export interface AuthUserDirectoryApiInterface {
+    /**
+     * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+     * @summary Delete an end user (server-side admin)
+     * @param {string} userId 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    deleteEndUserByApplicationRaw(requestParameters: AuthUserDirectoryApiDeleteEndUserByApplicationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+     * Delete an end user (server-side admin)
+     */
+    deleteEndUserByApplication(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+     * @summary Look up an end user by email (server-side admin)
+     * @param {string} email 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    getEndUserByEmailRaw(requestParameters: AuthUserDirectoryApiGetEndUserByEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+     * Look up an end user by email (server-side admin)
+     */
+    getEndUserByEmail(email: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+     * @summary Get an end user by id (server-side admin)
+     * @param {string} userId 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    getEndUserByIdRaw(requestParameters: AuthUserDirectoryApiGetEndUserByIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user by id (server-side admin)
+     */
+    getEndUserById(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+     * @summary Get an end user\'s stored custom claims (server-side admin)
+     * @param {string} userId 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    getEndUserClaimsRaw(requestParameters: AuthUserDirectoryApiGetEndUserClaimsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+     * Get an end user\'s stored custom claims (server-side admin)
+     */
+    getEndUserClaims(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * @summary Pre-provision (invite) an end user (server-side admin)
+     * @param {InviteEndUserRequest} inviteEndUserRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Pre-provision (invite) an end user (server-side admin)
+     */
+    inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+     * @summary List / search end users (server-side admin)
+     * @param {number} [page] 
+     * @param {number} [perPage] 
+     * @param {string} [search] Substring match against email, name, or phone number.
+     * @param {'test' | 'live'} [environment] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    listEndUsersRaw(requestParameters: AuthUserDirectoryApiListEndUsersRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+     * List / search end users (server-side admin)
+     */
+    listEndUsers(page?: number, perPage?: number, search?: string, environment?: ListEndUsersEnvironmentEnum, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+     * @summary Set an end user\'s stored custom claims (server-side admin)
+     * @param {string} userId 
+     * @param {SetEndUserClaimsRequest} setEndUserClaimsRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    setEndUserClaimsRaw(requestParameters: AuthUserDirectoryApiSetEndUserClaimsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+     * Set an end user\'s stored custom claims (server-side admin)
+     */
+    setEndUserClaims(userId: string, setEndUserClaimsRequest: SetEndUserClaimsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+    /**
+     * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+     * @summary Update an end user (server-side admin)
+     * @param {string} userId 
+     * @param {UpdateEndUserByApplicationRequest} updateEndUserByApplicationRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    updateEndUserByApplicationRaw(requestParameters: AuthUserDirectoryApiUpdateEndUserByApplicationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+     * Update an end user (server-side admin)
+     */
+    updateEndUserByApplication(userId: string, updateEndUserByApplicationRequest: UpdateEndUserByApplicationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
+}
+
+/**
+ * 
+ */
+export class AuthUserDirectoryApi extends runtime.BaseAPI implements AuthUserDirectoryApiInterface {
+
+    /**
+     * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+     * Delete an end user (server-side admin)
+     */
+    async deleteEndUserByApplicationRaw(requestParameters: AuthUserDirectoryApiDeleteEndUserByApplicationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling deleteEndUserByApplication().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+     * Delete an end user (server-side admin)
+     */
+    async deleteEndUserByApplication(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.deleteEndUserByApplicationRaw({ userId: userId }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+     * Look up an end user by email (server-side admin)
+     */
+    async getEndUserByEmailRaw(requestParameters: AuthUserDirectoryApiGetEndUserByEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['email'] == null) {
+            throw new runtime.RequiredError(
+                'email',
+                'Required parameter "email" was null or undefined when calling getEndUserByEmail().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        if (requestParameters['email'] != null) {
+            queryParameters['email'] = requestParameters['email'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/by-email`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+     * Look up an end user by email (server-side admin)
+     */
+    async getEndUserByEmail(email: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.getEndUserByEmailRaw({ email: email }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user by id (server-side admin)
+     */
+    async getEndUserByIdRaw(requestParameters: AuthUserDirectoryApiGetEndUserByIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling getEndUserById().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user by id (server-side admin)
+     */
+    async getEndUserById(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.getEndUserByIdRaw({ userId: userId }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+     * Get an end user\'s stored custom claims (server-side admin)
+     */
+    async getEndUserClaimsRaw(requestParameters: AuthUserDirectoryApiGetEndUserClaimsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling getEndUserClaims().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}/claims`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+     * Get an end user\'s stored custom claims (server-side admin)
+     */
+    async getEndUserClaims(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.getEndUserClaimsRaw({ userId: userId }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Pre-provision (invite) an end user (server-side admin)
+     */
+    async inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['inviteEndUserRequest'] == null) {
+            throw new runtime.RequiredError(
+                'inviteEndUserRequest',
+                'Required parameter "inviteEndUserRequest" was null or undefined when calling inviteEndUser().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/invite`,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: InviteEndUserRequestToJSON(requestParameters['inviteEndUserRequest']),
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Pre-provision (invite) an end user (server-side admin)
+     */
+    async inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.inviteEndUserRaw({ inviteEndUserRequest: inviteEndUserRequest }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+     * List / search end users (server-side admin)
+     */
+    async listEndUsersRaw(requestParameters: AuthUserDirectoryApiListEndUsersRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const queryParameters: any = {};
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['perPage'] != null) {
+            queryParameters['per_page'] = requestParameters['perPage'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['environment'] != null) {
+            queryParameters['environment'] = requestParameters['environment'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+     * List / search end users (server-side admin)
+     */
+    async listEndUsers(page?: number, perPage?: number, search?: string, environment?: ListEndUsersEnvironmentEnum, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.listEndUsersRaw({ page: page, perPage: perPage, search: search, environment: environment }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+     * Set an end user\'s stored custom claims (server-side admin)
+     */
+    async setEndUserClaimsRaw(requestParameters: AuthUserDirectoryApiSetEndUserClaimsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling setEndUserClaims().'
+            );
+        }
+
+        if (requestParameters['setEndUserClaimsRequest'] == null) {
+            throw new runtime.RequiredError(
+                'setEndUserClaimsRequest',
+                'Required parameter "setEndUserClaimsRequest" was null or undefined when calling setEndUserClaims().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}/claims`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: SetEndUserClaimsRequestToJSON(requestParameters['setEndUserClaimsRequest']),
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+     * Set an end user\'s stored custom claims (server-side admin)
+     */
+    async setEndUserClaims(userId: string, setEndUserClaimsRequest: SetEndUserClaimsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.setEndUserClaimsRaw({ userId: userId, setEndUserClaimsRequest: setEndUserClaimsRequest }, initOverrides);
+    }
+
+    /**
+     * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+     * Update an end user (server-side admin)
+     */
+    async updateEndUserByApplicationRaw(requestParameters: AuthUserDirectoryApiUpdateEndUserByApplicationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling updateEndUserByApplication().'
+            );
+        }
+
+        if (requestParameters['updateEndUserByApplicationRequest'] == null) {
+            throw new runtime.RequiredError(
+                'updateEndUserByApplicationRequest',
+                'Required parameter "updateEndUserByApplicationRequest" was null or undefined when calling updateEndUserByApplication().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: UpdateEndUserByApplicationRequestToJSON(requestParameters['updateEndUserByApplicationRequest']),
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+     * Update an end user (server-side admin)
+     */
+    async updateEndUserByApplication(userId: string, updateEndUserByApplicationRequest: UpdateEndUserByApplicationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.updateEndUserByApplicationRaw({ userId: userId, updateEndUserByApplicationRequest: updateEndUserByApplicationRequest }, initOverrides);
+    }
+
+}
+
+/**
+ * @export
+ */
+export const ListEndUsersEnvironmentEnum = {
+    TEST: 'test',
+    LIVE: 'live'
+} as const;
+export type ListEndUsersEnvironmentEnum = typeof ListEndUsersEnvironmentEnum[keyof typeof ListEndUsersEnvironmentEnum];