auth0 5.10.0 → 5.12.0

package/dist/cjs/lib/retry.d.ts

@@ -10,11 +10,16 @@ export interface RetryConfiguration {
     enabled?: boolean;
     /**
      * Configure the max amount of retries the SDK should do.
-     * Defaults to 5.
+     * Defaults to 3.
+     * Note: this budget is shared between HTTP status code retries (e.g. 429) and
+     * transient network error retries (e.g. ECONNRESET). For example, with maxRetries: 3,
+     * 2 network retries and 1 status code retry would exhaust the full budget.
      */
     maxRetries?: number;
     /**
-     * Status Codes on which the SDK should trigger retries.
+     * HTTP Status Codes on which the SDK should trigger retries.
+     * Note: transient network errors (ECONNRESET, EPIPE, ECONNABORTED) are always retried
+     * up to maxRetries regardless of this setting. Use `enabled: false` to disable all retries.
      * Defaults to [429].
      */
     retryWhen?: number[];

package/dist/cjs/lib/retry.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.retry = retry;
+const errors_js_1 = require("./errors.js");
 const MAX_REQUEST_RETRY_JITTER = 250;
 const MAX_REQUEST_RETRY_DELAY = 10000;
 const DEFAULT_NUMBER_RETRIES = 3;
@@ -38,6 +39,25 @@ function pause(delay) {
         return new Promise((resolve) => setTimeout(resolve, delay));
     });
 }
+// Transient network errors that are safe to retry — failures that can self-heal
+// without any config change (socket reset, broken pipe, aborted connection).
+// Deliberately excludes ENOTFOUND, ECONNREFUSED, cert errors — those won't self-heal.
+const RETRYABLE_ERROR_CODES = new Set(["ECONNRESET", "EPIPE", "ECONNABORTED"]);
+function isRetryableNetworkError(e) {
+    var _a, _b, _c;
+    if (typeof e !== "object" || e === null)
+        return false;
+    // Check both e.code (old request-lib / nock shape) and e.cause.code
+    // (native fetch / undici shape: TypeError: fetch failed { cause: { code } })
+    const err = e;
+    const code = (_c = (_a = err.code) !== null && _a !== void 0 ? _a : (_b = err.cause) === null || _b === void 0 ? void 0 : _b.code) !== null && _c !== void 0 ? _c : "";
+    return RETRYABLE_ERROR_CODES.has(code);
+}
+function calculateWait(nrOfTries) {
+    let wait = BASE_DELAY * Math.pow(2, nrOfTries - 1);
+    wait = getRandomInt(wait + 1, wait + MAX_REQUEST_RETRY_JITTER);
+    return Math.min(wait, MAX_REQUEST_RETRY_DELAY);
+}
 /**
  * @private
  * Function that retries the provided action callback for a configurable amount of time, defaults to 3.
@@ -47,13 +67,23 @@ function retry(action, { maxRetries, retryWhen }) {
     let nrOfTries = 0;
     const retryAndWait = () => __awaiter(this, void 0, void 0, function* () {
         let result;
-        result = yield action();
+        try {
+            result = yield action();
+        }
+        catch (e) {
+            if (e instanceof errors_js_1.TimeoutError) {
+                throw e;
+            }
+            if (isRetryableNetworkError(e) && nrOfTries < nrOfTriesToAttempt) {
+                nrOfTries++;
+                yield pause(calculateWait(nrOfTries));
+                return retryAndWait();
+            }
+            throw e;
+        }
         if ((retryWhen || [429]).includes(result.status) && nrOfTries < nrOfTriesToAttempt) {
             nrOfTries++;
-            let wait = BASE_DELAY * Math.pow(2, nrOfTries - 1);
-            wait = getRandomInt(wait + 1, wait + MAX_REQUEST_RETRY_JITTER);
-            wait = Math.min(wait, MAX_REQUEST_RETRY_DELAY);
-            yield pause(wait);
+            yield pause(calculateWait(nrOfTries));
             result = yield retryAndWait();
         }
         return result;

package/dist/cjs/management/BaseClient.d.ts

@@ -1,6 +1,7 @@
 import { BearerAuthProvider } from "./auth/BearerAuthProvider.js";
 import * as core from "./core/index.js";
 import * as environments from "./environments.js";
+export type AuthOption = false | core.AuthProvider["getAuthRequest"] | core.AuthProvider | BearerAuthProvider.AuthOptions;
 export type BaseClientOptions = {
     environment?: core.Supplier<environments.ManagementEnvironment | string>;
     /** Specify a custom URL to connect the client to. */
@@ -16,6 +17,8 @@ export type BaseClientOptions = {
     fetcher?: core.FetchFunction;
     /** Configure logging for the client. */
     logging?: core.logging.LogConfig | core.logging.Logger;
+    /** Override auth. Pass false to disable, a function returning auth headers, an AuthProvider, or auth options. */
+    auth?: AuthOption;
 } & BearerAuthProvider.AuthOptions;
 export interface BaseRequestOptions {
     /** The maximum time to wait for a response in seconds. */

package/dist/cjs/management/BaseClient.js

@@ -44,6 +44,21 @@ function normalizeClientOptions(options) {
 function normalizeClientOptionsWithAuth(options) {
     var _a;
     const normalized = normalizeClientOptions(options);
+    if (options.auth === false) {
+        normalized.authProvider = new core.NoOpAuthProvider();
+        return normalized;
+    }
+    if (options.auth != null) {
+        if (typeof options.auth === "function") {
+            normalized.authProvider = { getAuthRequest: options.auth };
+            return normalized;
+        }
+        if (core.isAuthProvider(options.auth)) {
+            normalized.authProvider = options.auth;
+            return normalized;
+        }
+        Object.assign(normalized, options.auth);
+    }
     const normalizedWithNoOpAuthProvider = withNoOpAuthProvider(normalized);
     (_a = normalized.authProvider) !== null && _a !== void 0 ? _a : (normalized.authProvider = new BearerAuthProvider_js_1.BearerAuthProvider(normalizedWithNoOpAuthProvider));
     return normalized;

package/dist/cjs/management/Client.d.ts

@@ -24,6 +24,7 @@ import { LogStreamsClient } from "./api/resources/logStreams/client/Client.js";
 import { NetworkAclsClient } from "./api/resources/networkAcls/client/Client.js";
 import { OrganizationsClient } from "./api/resources/organizations/client/Client.js";
 import { PromptsClient } from "./api/resources/prompts/client/Client.js";
+import { RateLimitPoliciesClient } from "./api/resources/rateLimitPolicies/client/Client.js";
 import { RefreshTokensClient } from "./api/resources/refreshTokens/client/Client.js";
 import { ResourceServersClient } from "./api/resources/resourceServers/client/Client.js";
 import { RiskAssessmentsClient } from "./api/resources/riskAssessments/client/Client.js";
@@ -74,6 +75,7 @@ export declare class ManagementClient {
     protected _networkAcls: NetworkAclsClient | undefined;
     protected _organizations: OrganizationsClient | undefined;
     protected _prompts: PromptsClient | undefined;
+    protected _rateLimitPolicies: RateLimitPoliciesClient | undefined;
     protected _refreshTokens: RefreshTokensClient | undefined;
     protected _resourceServers: ResourceServersClient | undefined;
     protected _roles: RolesClient | undefined;
@@ -119,6 +121,7 @@ export declare class ManagementClient {
     get networkAcls(): NetworkAclsClient;
     get organizations(): OrganizationsClient;
     get prompts(): PromptsClient;
+    get rateLimitPolicies(): RateLimitPoliciesClient;
     get refreshTokens(): RefreshTokensClient;
     get resourceServers(): ResourceServersClient;
     get roles(): RolesClient;

package/dist/cjs/management/Client.js

@@ -70,24 +70,25 @@ const Client_js_23 = require("./api/resources/logStreams/client/Client.js");
 const Client_js_24 = require("./api/resources/networkAcls/client/Client.js");
 const Client_js_25 = require("./api/resources/organizations/client/Client.js");
 const Client_js_26 = require("./api/resources/prompts/client/Client.js");
-const Client_js_27 = require("./api/resources/refreshTokens/client/Client.js");
-const Client_js_28 = require("./api/resources/resourceServers/client/Client.js");
-const Client_js_29 = require("./api/resources/riskAssessments/client/Client.js");
-const Client_js_30 = require("./api/resources/roles/client/Client.js");
-const Client_js_31 = require("./api/resources/rules/client/Client.js");
-const Client_js_32 = require("./api/resources/rulesConfigs/client/Client.js");
-const Client_js_33 = require("./api/resources/selfServiceProfiles/client/Client.js");
-const Client_js_34 = require("./api/resources/sessions/client/Client.js");
-const Client_js_35 = require("./api/resources/stats/client/Client.js");
-const Client_js_36 = require("./api/resources/supplementalSignals/client/Client.js");
-const Client_js_37 = require("./api/resources/tenants/client/Client.js");
-const Client_js_38 = require("./api/resources/tickets/client/Client.js");
-const Client_js_39 = require("./api/resources/tokenExchangeProfiles/client/Client.js");
-const Client_js_40 = require("./api/resources/userAttributeProfiles/client/Client.js");
-const Client_js_41 = require("./api/resources/userBlocks/client/Client.js");
-const Client_js_42 = require("./api/resources/userGrants/client/Client.js");
-const Client_js_43 = require("./api/resources/users/client/Client.js");
-const Client_js_44 = require("./api/resources/verifiableCredentials/client/Client.js");
+const Client_js_27 = require("./api/resources/rateLimitPolicies/client/Client.js");
+const Client_js_28 = require("./api/resources/refreshTokens/client/Client.js");
+const Client_js_29 = require("./api/resources/resourceServers/client/Client.js");
+const Client_js_30 = require("./api/resources/riskAssessments/client/Client.js");
+const Client_js_31 = require("./api/resources/roles/client/Client.js");
+const Client_js_32 = require("./api/resources/rules/client/Client.js");
+const Client_js_33 = require("./api/resources/rulesConfigs/client/Client.js");
+const Client_js_34 = require("./api/resources/selfServiceProfiles/client/Client.js");
+const Client_js_35 = require("./api/resources/sessions/client/Client.js");
+const Client_js_36 = require("./api/resources/stats/client/Client.js");
+const Client_js_37 = require("./api/resources/supplementalSignals/client/Client.js");
+const Client_js_38 = require("./api/resources/tenants/client/Client.js");
+const Client_js_39 = require("./api/resources/tickets/client/Client.js");
+const Client_js_40 = require("./api/resources/tokenExchangeProfiles/client/Client.js");
+const Client_js_41 = require("./api/resources/userAttributeProfiles/client/Client.js");
+const Client_js_42 = require("./api/resources/userBlocks/client/Client.js");
+const Client_js_43 = require("./api/resources/userGrants/client/Client.js");
+const Client_js_44 = require("./api/resources/users/client/Client.js");
+const Client_js_45 = require("./api/resources/verifiableCredentials/client/Client.js");
 const BaseClient_js_1 = require("./BaseClient.js");
 const core = __importStar(require("./core/index.js"));
 class ManagementClient {
@@ -148,7 +149,7 @@ class ManagementClient {
     }
     get userGrants() {
         var _a;
-        return ((_a = this._userGrants) !== null && _a !== void 0 ? _a : (this._userGrants = new Client_js_42.UserGrantsClient(this._options)));
+        return ((_a = this._userGrants) !== null && _a !== void 0 ? _a : (this._userGrants = new Client_js_43.UserGrantsClient(this._options)));
     }
     get groups() {
         var _a;
@@ -182,61 +183,65 @@ class ManagementClient {
         var _a;
         return ((_a = this._prompts) !== null && _a !== void 0 ? _a : (this._prompts = new Client_js_26.PromptsClient(this._options)));
     }
+    get rateLimitPolicies() {
+        var _a;
+        return ((_a = this._rateLimitPolicies) !== null && _a !== void 0 ? _a : (this._rateLimitPolicies = new Client_js_27.RateLimitPoliciesClient(this._options)));
+    }
     get refreshTokens() {
         var _a;
-        return ((_a = this._refreshTokens) !== null && _a !== void 0 ? _a : (this._refreshTokens = new Client_js_27.RefreshTokensClient(this._options)));
+        return ((_a = this._refreshTokens) !== null && _a !== void 0 ? _a : (this._refreshTokens = new Client_js_28.RefreshTokensClient(this._options)));
     }
     get resourceServers() {
         var _a;
-        return ((_a = this._resourceServers) !== null && _a !== void 0 ? _a : (this._resourceServers = new Client_js_28.ResourceServersClient(this._options)));
+        return ((_a = this._resourceServers) !== null && _a !== void 0 ? _a : (this._resourceServers = new Client_js_29.ResourceServersClient(this._options)));
     }
     get roles() {
         var _a;
-        return ((_a = this._roles) !== null && _a !== void 0 ? _a : (this._roles = new Client_js_30.RolesClient(this._options)));
+        return ((_a = this._roles) !== null && _a !== void 0 ? _a : (this._roles = new Client_js_31.RolesClient(this._options)));
     }
     get rules() {
         var _a;
-        return ((_a = this._rules) !== null && _a !== void 0 ? _a : (this._rules = new Client_js_31.RulesClient(this._options)));
+        return ((_a = this._rules) !== null && _a !== void 0 ? _a : (this._rules = new Client_js_32.RulesClient(this._options)));
     }
     get rulesConfigs() {
         var _a;
-        return ((_a = this._rulesConfigs) !== null && _a !== void 0 ? _a : (this._rulesConfigs = new Client_js_32.RulesConfigsClient(this._options)));
+        return ((_a = this._rulesConfigs) !== null && _a !== void 0 ? _a : (this._rulesConfigs = new Client_js_33.RulesConfigsClient(this._options)));
     }
     get selfServiceProfiles() {
         var _a;
-        return ((_a = this._selfServiceProfiles) !== null && _a !== void 0 ? _a : (this._selfServiceProfiles = new Client_js_33.SelfServiceProfilesClient(this._options)));
+        return ((_a = this._selfServiceProfiles) !== null && _a !== void 0 ? _a : (this._selfServiceProfiles = new Client_js_34.SelfServiceProfilesClient(this._options)));
     }
     get sessions() {
         var _a;
-        return ((_a = this._sessions) !== null && _a !== void 0 ? _a : (this._sessions = new Client_js_34.SessionsClient(this._options)));
+        return ((_a = this._sessions) !== null && _a !== void 0 ? _a : (this._sessions = new Client_js_35.SessionsClient(this._options)));
     }
     get stats() {
         var _a;
-        return ((_a = this._stats) !== null && _a !== void 0 ? _a : (this._stats = new Client_js_35.StatsClient(this._options)));
+        return ((_a = this._stats) !== null && _a !== void 0 ? _a : (this._stats = new Client_js_36.StatsClient(this._options)));
     }
     get supplementalSignals() {
         var _a;
-        return ((_a = this._supplementalSignals) !== null && _a !== void 0 ? _a : (this._supplementalSignals = new Client_js_36.SupplementalSignalsClient(this._options)));
+        return ((_a = this._supplementalSignals) !== null && _a !== void 0 ? _a : (this._supplementalSignals = new Client_js_37.SupplementalSignalsClient(this._options)));
     }
     get tickets() {
         var _a;
-        return ((_a = this._tickets) !== null && _a !== void 0 ? _a : (this._tickets = new Client_js_38.TicketsClient(this._options)));
+        return ((_a = this._tickets) !== null && _a !== void 0 ? _a : (this._tickets = new Client_js_39.TicketsClient(this._options)));
     }
     get tokenExchangeProfiles() {
         var _a;
-        return ((_a = this._tokenExchangeProfiles) !== null && _a !== void 0 ? _a : (this._tokenExchangeProfiles = new Client_js_39.TokenExchangeProfilesClient(this._options)));
+        return ((_a = this._tokenExchangeProfiles) !== null && _a !== void 0 ? _a : (this._tokenExchangeProfiles = new Client_js_40.TokenExchangeProfilesClient(this._options)));
     }
     get userAttributeProfiles() {
         var _a;
-        return ((_a = this._userAttributeProfiles) !== null && _a !== void 0 ? _a : (this._userAttributeProfiles = new Client_js_40.UserAttributeProfilesClient(this._options)));
+        return ((_a = this._userAttributeProfiles) !== null && _a !== void 0 ? _a : (this._userAttributeProfiles = new Client_js_41.UserAttributeProfilesClient(this._options)));
     }
     get userBlocks() {
         var _a;
-        return ((_a = this._userBlocks) !== null && _a !== void 0 ? _a : (this._userBlocks = new Client_js_41.UserBlocksClient(this._options)));
+        return ((_a = this._userBlocks) !== null && _a !== void 0 ? _a : (this._userBlocks = new Client_js_42.UserBlocksClient(this._options)));
     }
     get users() {
         var _a;
-        return ((_a = this._users) !== null && _a !== void 0 ? _a : (this._users = new Client_js_43.UsersClient(this._options)));
+        return ((_a = this._users) !== null && _a !== void 0 ? _a : (this._users = new Client_js_44.UsersClient(this._options)));
     }
     get anomaly() {
         var _a;
@@ -260,15 +265,15 @@ class ManagementClient {
     }
     get riskAssessments() {
         var _a;
-        return ((_a = this._riskAssessments) !== null && _a !== void 0 ? _a : (this._riskAssessments = new Client_js_29.RiskAssessmentsClient(this._options)));
+        return ((_a = this._riskAssessments) !== null && _a !== void 0 ? _a : (this._riskAssessments = new Client_js_30.RiskAssessmentsClient(this._options)));
     }
     get tenants() {
         var _a;
-        return ((_a = this._tenants) !== null && _a !== void 0 ? _a : (this._tenants = new Client_js_37.TenantsClient(this._options)));
+        return ((_a = this._tenants) !== null && _a !== void 0 ? _a : (this._tenants = new Client_js_38.TenantsClient(this._options)));
     }
     get verifiableCredentials() {
         var _a;
-        return ((_a = this._verifiableCredentials) !== null && _a !== void 0 ? _a : (this._verifiableCredentials = new Client_js_44.VerifiableCredentialsClient(this._options)));
+        return ((_a = this._verifiableCredentials) !== null && _a !== void 0 ? _a : (this._verifiableCredentials = new Client_js_45.VerifiableCredentialsClient(this._options)));
     }
     /**
      * Make a passthrough request using the SDK's configured auth, retry, logging, etc.

package/dist/cjs/management/api/requests/requests.d.ts

@@ -103,7 +103,6 @@ export interface UpdateBrandingRequestContent {
     favicon_url?: string | null;
     /** URL for the logo. Must use HTTPS. */
     logo_url?: string | null;
-    identifiers?: Management.UpdateBrandingIdentifiers | null;
     font?: Management.UpdateBrandingFont | null;
 }
 /**
@@ -272,6 +271,7 @@ export interface CreateClientRequestContent {
     /** Initiate login uri, must be https */
     initiate_login_uri?: string;
     native_social_login?: Management.NativeSocialLogin;
+    fedcm_login?: Management.FedCmLogin;
     refresh_token?: Management.ClientRefreshTokenConfiguration | null;
     default_organization?: Management.ClientDefaultOrganization | null;
     organization_usage?: Management.ClientOrganizationUsageEnum;
@@ -402,6 +402,7 @@ export interface UpdateClientRequestContent {
     /** Initiate login uri, must be https */
     initiate_login_uri?: string;
     native_social_login?: Management.NativeSocialLogin;
+    fedcm_login?: Management.FedCmLogin;
     refresh_token?: Management.ClientRefreshTokenConfiguration | null;
     default_organization?: Management.ClientDefaultOrganization | null;
     organization_usage?: Management.ClientOrganizationUsagePatchEnum | null;
@@ -1199,6 +1200,57 @@ export interface UpdateSettingsRequestContent {
     /** Use WebAuthn with Device Biometrics as the first authentication factor */
     webauthn_platform_first_factor?: boolean | null;
 }
+/**
+ * @example
+ *     {
+ *         resource: "oauth_authentication_api",
+ *         consumer: "client",
+ *         consumer_selector: "consumer_selector",
+ *         take: 1,
+ *         from: "from"
+ *     }
+ */
+export interface ListRateLimitPoliciesRequestParameters {
+    /** The API protected by the Rate Limit Policy. */
+    resource?: Management.RateLimitPolicyResourceEnum | null;
+    /** The consumer to which the rate limit policy applies. */
+    consumer?: Management.RateLimitPolicyConsumerEnum | null;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+    /** Cursor for pagination. */
+    from?: string | null;
+}
+/**
+ * @example
+ *     {
+ *         resource: "oauth_authentication_api",
+ *         consumer: "client",
+ *         consumer_selector: "consumer_selector",
+ *         configuration: {
+ *             action: "allow"
+ *         }
+ *     }
+ */
+export interface CreateRateLimitPolicyRequestContent {
+    resource: Management.RateLimitPolicyResourceEnum;
+    consumer: Management.RateLimitPolicyConsumerEnum;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector: string;
+    configuration: Management.RateLimitPolicyConfiguration;
+}
+/**
+ * @example
+ *     {
+ *         configuration: {
+ *             action: "allow"
+ *         }
+ *     }
+ */
+export interface PatchRateLimitPolicyRequestContent {
+    configuration: Management.PatchRateLimitPolicyConfigurationRequestContent;
+}
 /**
  * @example
  *     {
@@ -1233,7 +1285,7 @@ export interface RevokeRefreshTokensRequestContent {
     ids?: string[];
     /** Revoke all refresh tokens for this user. */
     user_id?: string;
-    /** Revoke all refresh tokens for this client. */
+    /** Revoke refresh tokens for this client. Must be paired with `user_id`; optionally narrowed further with `audience`. */
     client_id?: string;
     /** Resource server identifier (audience) to scope the revocation. Must be used with both `user_id` and `client_id`. */
     audience?: string;
@@ -2638,6 +2690,39 @@ export interface GetGroupMembersRequestParameters {
     /** Number of results per page. Defaults to 50. */
     take?: number | null;
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListGroupRolesRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
+/**
+ * @example
+ *     {
+ *         roles: ["roles"]
+ *     }
+ */
+export interface CreateGroupRolesRequestParameters {
+    /** Array of role IDs to assign to the group. */
+    roles: string[];
+}
+/**
+ * @example
+ *     {
+ *         roles: ["roles"]
+ *     }
+ */
+export interface DeleteGroupRolesRequestContent {
+    /** Array of role IDs to remove from the group. */
+    roles: string[];
+}
 /**
  * @example
  *     {
@@ -3213,6 +3298,65 @@ export interface DeleteOrganizationMembersRequestContent {
     /** List of user IDs to remove from the organization. */
     members: string[];
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListOrganizationGroupsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListOrganizationGroupRolesRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
+/**
+ * @example
+ *     {
+ *         roles: ["roles"]
+ *     }
+ */
+export interface CreateOrganizationGroupRolesRequestContent {
+    /** Array of role IDs to assign to organization group. */
+    roles: string[];
+}
+/**
+ * @example
+ *     {
+ *         roles: ["roles"]
+ *     }
+ */
+export interface DeleteOrganizationGroupRolesRequestContent {
+    /** Array of role IDs to delete from organization group. */
+    roles: string[];
+}
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListOrganizationMemberEffectiveRolesRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
 /**
  * @example
  *     {
@@ -3249,6 +3393,22 @@ export interface DeleteOrganizationMemberRolesRequestContent {
     /** List of roles IDs associated with the organization member to remove. */
     roles: string[];
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         role_id: "role_id"
+ *     }
+ */
+export interface ListOrganizationMemberRoleSourceGroupsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+    /** The role ID to get group sources for. */
+    role_id: string;
+}
 /**
  * @example
  *     {
@@ -3328,6 +3488,39 @@ export interface UpdateRiskAssessmentsSettingsNewDeviceRequestContent {
     /** Length of time to remember devices for, in days. */
     remember_for: number;
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListRoleGroupsParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
+/**
+ * @example
+ *     {
+ *         groups: ["groups"]
+ *     }
+ */
+export interface AssignRoleGroupsRequestContent {
+    /** Array of group IDs to assign to the role. */
+    groups: string[];
+}
+/**
+ * @example
+ *     {
+ *         groups: ["groups"]
+ *     }
+ */
+export interface DeleteRoleGroupsRequestContent {
+    /** Array of group IDs to remove from the role. */
+    groups: string[];
+}
 /**
  * @example
  *     {
@@ -3454,12 +3647,20 @@ export interface UpdateTenantSettingsRequestContent {
     allowed_logout_urls?: string[];
     /** Number of hours a session will stay valid. */
     session_lifetime?: number;
+    /** Number of minutes a session will stay valid. Cannot be specified together with `session_lifetime`. */
+    session_lifetime_in_minutes?: number;
     /** Number of hours for which a session can be inactive before the user must log in again. */
     idle_session_lifetime?: number;
+    /** Number of minutes a session can be inactive before the user must log in again. Cannot be specified together with `idle_session_lifetime`. */
+    idle_session_lifetime_in_minutes?: number;
     /** Number of hours an ephemeral (non-persistent) session will stay valid. */
     ephemeral_session_lifetime?: number;
     /** Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again. */
     idle_ephemeral_session_lifetime?: number;
+    /** Number of minutes an ephemeral (non-persistent) session will stay valid. Cannot be specified together with `ephemeral_session_lifetime`. */
+    ephemeral_session_lifetime_in_minutes?: number;
+    /** Number of minutes an ephemeral (non-persistent) session can be inactive before the user must log in again. Cannot be specified together with `idle_ephemeral_session_lifetime`. */
+    idle_ephemeral_session_lifetime_in_minutes?: number;
     /** Selected sandbox version for the extensibility environment */
     sandbox_version?: string;
     /** Selected legacy sandbox version for the extensibility environment */
@@ -3468,6 +3669,7 @@ export interface UpdateTenantSettingsRequestContent {
     default_redirection_uri?: string;
     /** Supported locales for the user interface */
     enabled_locales?: Management.TenantSettingsSupportedLocalesEnum[];
+    security_headers?: Management.TenantSettingsNullableSecurityHeaders | null;
     session_cookie?: Management.SessionCookieSchema | null;
     sessions?: Management.TenantSettingsSessions | null;
     oidc_logout?: Management.TenantOidcLogoutSettings;
@@ -3495,7 +3697,10 @@ export interface UpdateTenantSettingsRequestContent {
     enable_ai_guide?: boolean;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean;
+    /** Whether session metadata is included in specific tenant logs (slo, oidc_backchannel_logout_failed, oidc_backchannel_logout_succeeded). */
+    include_session_metadata_in_tenant_logs?: boolean;
     dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode;
+    country_codes?: Management.TenantSettingsCountryCodes | null;
 }
 /**
  * @example
@@ -3573,6 +3778,35 @@ export interface GetUserConnectedAccountsRequestParameters {
     /** Number of results to return.  Defaults to 10 with a maximum of 20 */
     take?: number | null;
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         resource_server_identifier: "resource_server_identifier"
+ *     }
+ */
+export interface ListUserEffectivePermissionsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+    /** The identifier of the resource server for which to calculate user permissions. */
+    resource_server_identifier: string;
+}
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListUserEffectiveRolesRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
 /**
  * @example
  *     {
@@ -3757,6 +3991,41 @@ export interface ListUserSessionsRequestParameters {
     /** Number of results per page. Defaults to 50. */
     take?: number | null;
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         resource_server_identifier: "resource_server_identifier",
+ *         permission_name: "permission_name"
+ *     }
+ */
+export interface ListUserEffectivePermissionRoleSourceRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+    /** The identifier of the resource server for which to calculate user permissions. */
+    resource_server_identifier: string;
+    /** Name of this permission */
+    permission_name: string;
+}
+/**
+ * @example
+ *     {
+ *         role_id: "role_id",
+ *         from: "from",
+ *         take: 1
+ *     }
+ */
+export interface ListUserRoleSourceGroupsRequestParameters {
+    /** ID of the role to get source groups for. */
+    role_id: string;
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of results per page. Defaults to 50. */
+    take?: number | null;
+}
 /**
  * @example
  *     {