auth0 5.10.0 → 5.12.0

package/dist/esm/management/api/types/types.d.mts

@@ -297,6 +297,15 @@ export declare const OauthScope: {
     /**
      * Read Group Members */
     readonly ReadGroupMembers: "read:group_members";
+    /**
+     * Create Group Roles */
+    readonly CreateGroupRoles: "create:group_roles";
+    /**
+     * Read Group Roles */
+    readonly ReadGroupRoles: "read:group_roles";
+    /**
+     * Delete Group Roles */
+    readonly DeleteGroupRoles: "delete:group_roles";
     /**
      * Read Groups */
     readonly ReadGroups: "read:groups";
@@ -399,6 +408,18 @@ export declare const OauthScope: {
     /**
      * Delete Organization Discovery Domains */
     readonly DeleteOrganizationDiscoveryDomains: "delete:organization_discovery_domains";
+    /**
+     * Create Organization Group Roles */
+    readonly CreateOrganizationGroupRoles: "create:organization_group_roles";
+    /**
+     * Read Organization Group Roles */
+    readonly ReadOrganizationGroupRoles: "read:organization_group_roles";
+    /**
+     * Delete Organization Group Roles */
+    readonly DeleteOrganizationGroupRoles: "delete:organization_group_roles";
+    /**
+     * Read Organization Groups */
+    readonly ReadOrganizationGroups: "read:organization_groups";
     /**
      * Create Organization Invitations */
     readonly CreateOrganizationInvitations: "create:organization_invitations";
@@ -408,6 +429,12 @@ export declare const OauthScope: {
     /**
      * Delete Organization Invitations */
     readonly DeleteOrganizationInvitations: "delete:organization_invitations";
+    /**
+     * Read Organization Member Effective Roles */
+    readonly ReadOrganizationMemberEffectiveRoles: "read:organization_member_effective_roles";
+    /**
+     * Read Organization Member Role Source Groups */
+    readonly ReadOrganizationMemberRoleSourceGroups: "read:organization_member_role_source_groups";
     /**
      * Create Organization Member Roles */
     readonly CreateOrganizationMemberRoles: "create:organization_member_roles";
@@ -471,6 +498,18 @@ export declare const OauthScope: {
     /**
      * Update Prompts */
     readonly UpdatePrompts: "update:prompts";
+    /**
+     * Create Rate Limit Policies */
+    readonly CreateRateLimitPolicies: "create:rate_limit_policies";
+    /**
+     * Read Rate Limit Policies */
+    readonly ReadRateLimitPolicies: "read:rate_limit_policies";
+    /**
+     * Update Rate Limit Policies */
+    readonly UpdateRateLimitPolicies: "update:rate_limit_policies";
+    /**
+     * Delete Rate Limit Policies */
+    readonly DeleteRateLimitPolicies: "delete:rate_limit_policies";
     /**
      * Read Refresh Tokens */
     readonly ReadRefreshTokens: "read:refresh_tokens";
@@ -630,9 +669,21 @@ export declare const OauthScope: {
     /**
      * Delete User Attribute Profiles */
     readonly DeleteUserAttributeProfiles: "delete:user_attribute_profiles";
+    /**
+     * Read User Effective Permissions */
+    readonly ReadUserEffectivePermissions: "read:user_effective_permissions";
+    /**
+     * Read User Effective Roles */
+    readonly ReadUserEffectiveRoles: "read:user_effective_roles";
     /**
      * Read User Idp Tokens */
     readonly ReadUserIdpTokens: "read:user_idp_tokens";
+    /**
+     * Read User Permission Source Roles */
+    readonly ReadUserPermissionSourceRoles: "read:user_permission_source_roles";
+    /**
+     * Read User Role Source Groups */
+    readonly ReadUserRoleSourceGroups: "read:user_role_source_groups";
     /**
      * Create User Tickets */
     readonly CreateUserTickets: "create:user_tickets";
@@ -1107,6 +1158,7 @@ export declare const AculContextEnum: {
     readonly UntrustedDataAuthorizationParamsUiLocales: "untrusted_data.authorization_params.ui_locales";
     readonly UserOrganizations: "user.organizations";
     readonly TransactionCustomDomainDomain: "transaction.custom_domain.domain";
+    readonly Experiment: "experiment";
 };
 export type AculContextEnum = (typeof AculContextEnum)[keyof typeof AculContextEnum];
 /**
@@ -1425,55 +1477,20 @@ export interface BrandingFont {
     /** URL for the custom font. The URL must point to a font file and not a stylesheet. Must use HTTPS. */
     url?: string | undefined;
 }
-/**
- * Identifier input display settings.
- */
-export interface BrandingIdentifiers {
-    login_display?: Management.BrandingLoginDisplayEnum | undefined;
-    /** Whether OTP autocomplete (autocomplete="one-time-code") is enabled. */
-    otp_autocomplete?: boolean | undefined;
-    phone_display?: Management.BrandingPhoneDisplay | undefined;
-}
-/** Controls identifier input presentation on the login flow. Defaults to "unified" for legacy tenants, "separate" for tenants created post-GA of this feature. */
-export declare const BrandingLoginDisplayEnum: {
-    readonly Unified: "unified";
-    readonly Separate: "separate";
-};
-export type BrandingLoginDisplayEnum = (typeof BrandingLoginDisplayEnum)[keyof typeof BrandingLoginDisplayEnum];
 /**
  * Page Background Color or Gradient.
- * Property contains either <code>null</code> to unset, a solid color as a string value <code>#FFFFFF</code>, or a gradient as an object.
+ * Property contains either `null` to unset, a solid color as a string value `#FFFFFF`, or a gradient as an object.
  *
- * <pre><code>
+ * ```js
  * {
  *   type: 'linear-gradient',
  *   start: '#FFFFFF',
  *   end: '#000000',
  *   angle_deg: 35
  * }
- * </code></pre>
+ * ```
  */
 export type BrandingPageBackground = (string | null) | undefined | (Record<string, unknown> | null) | undefined;
-/**
- * Phone number display settings.
- */
-export interface BrandingPhoneDisplay {
-    masking?: Management.BrandingPhoneMaskingEnum | undefined;
-    formatting?: Management.BrandingPhoneFormattingEnum | undefined;
-}
-/** Controls the format used when displaying phone numbers. */
-export declare const BrandingPhoneFormattingEnum: {
-    readonly Regional: "regional";
-    readonly International: "international";
-};
-export type BrandingPhoneFormattingEnum = (typeof BrandingPhoneFormattingEnum)[keyof typeof BrandingPhoneFormattingEnum];
-/** Controls how phone numbers are masked when displayed back to users. */
-export declare const BrandingPhoneMaskingEnum: {
-    readonly ShowAll: "show_all";
-    readonly HideCountryCode: "hide_country_code";
-    readonly MaskDigits: "mask_digits";
-};
-export type BrandingPhoneMaskingEnum = (typeof BrandingPhoneMaskingEnum)[keyof typeof BrandingPhoneMaskingEnum];
 export interface BrandingThemeBorders {
     /** Button border radius */
     button_border_radius: number;
@@ -2490,9 +2507,10 @@ export declare const ClientExternalMetadataCreatedByEnum: {
     readonly Client: "client";
 };
 export type ClientExternalMetadataCreatedByEnum = (typeof ClientExternalMetadataCreatedByEnum)[keyof typeof ClientExternalMetadataCreatedByEnum];
-/** Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document. */
+/** Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document. The value <code>dcr</code> identifies clients registered via Dynamic Client Registration. */
 export declare const ClientExternalMetadataTypeEnum: {
     readonly Cimd: "cimd";
+    readonly Dcr: "dcr";
 };
 export type ClientExternalMetadataTypeEnum = (typeof ClientExternalMetadataTypeEnum)[keyof typeof ClientExternalMetadataTypeEnum];
 /**
@@ -2625,6 +2643,8 @@ export interface ClientMyOrganizationPatchConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration related to the My Organization Configuration for the client.
@@ -2637,6 +2657,8 @@ export interface ClientMyOrganizationPostConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration related to the My Organization Configuration for the client.
@@ -2649,6 +2671,8 @@ export interface ClientMyOrganizationResponseConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration for OIDC backchannel logout initiators
@@ -3041,7 +3065,7 @@ export type ConnectionAuthorizationEndpoint = string;
 /**
  * Base URL override for the Exact Online API endpoint used for OAuth2 authorization and API requests. Defaults to https://start.exactonline.nl.
  */
-export type ConnectionBaseUrlExact = Management.ConnectionHttpsUrlWithHttpFallback;
+export type ConnectionBaseUrlExact = string;
 /**
  * Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.
  */
@@ -3076,22 +3100,25 @@ export type ConnectionClientIdBitbucket = string;
  */
 export type ConnectionClientId = string;
 /**
- * OAuth 2.0 client identifier obtained from Amazon Developer Console during Login with Amazon application registration. When not provided, Auth0 development keys are used for testing purposes.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdAmazon = Management.ConnectionClientId;
-export type ConnectionClientIdAzureAd = Management.ConnectionClientId;
+export type ConnectionClientIdAmazon = string;
 /**
- * OAuth2.0 client identifier for the Exact Online connection, obtained when registering your application in the Exact App Center.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdExact = Management.ConnectionClientId;
+export type ConnectionClientIdAzureAd = string;
 /**
- * Your Facebook App ID. You can find this in your [Facebook Developers Console](https://developers.facebook.com/apps) under the App Settings section.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdFacebook = Management.ConnectionClientId;
+export type ConnectionClientIdExact = string;
 /**
- * Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdGoogleApps = Management.ConnectionClientId;
+export type ConnectionClientIdFacebook = string;
+/**
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
+ */
+export type ConnectionClientIdGoogleApps = string;
 /**
  * Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.
  */
@@ -3105,15 +3132,21 @@ export type ConnectionClientIdLine = string;
  */
 export type ConnectionClientIdLinkedin = string;
 /**
- * OAuth 1.0a client ID (consumer key) that identifies the client to the provider and is used to sign OAuth 1.0a requests.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
+ */
+export type ConnectionClientIdOAuth1 = string;
+/**
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
+ */
+export type ConnectionClientIdOAuth2 = string;
+/**
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdOAuth1 = Management.ConnectionClientId;
-export type ConnectionClientIdOAuth2 = Management.ConnectionClientId;
-export type ConnectionClientIdOidc = Management.ConnectionClientId;
+export type ConnectionClientIdOidc = string;
 /**
- * OAuth 2.0 client identifier issued by PayPal during application registration. This value identifies your Auth0 connection to PayPal. Leave empty to use Auth0 Dev Keys.
+ * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
-export type ConnectionClientIdPaypal = Management.ConnectionClientId;
+export type ConnectionClientIdPaypal = string;
 /**
  * The OAuth 2.0 client identifier
  */
@@ -3131,26 +3164,29 @@ export type ConnectionClientProtocolSaml = Management.ConnectionOptionsIdpInitia
  */
 export type ConnectionClientSecret = string;
 /**
- * OAuth 2.0 client secret obtained from Amazon Developer Console during Login with Amazon application registration. Used to authenticate your application when exchanging authorization codes for tokens.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretAmazon = Management.ConnectionClientSecret;
+export type ConnectionClientSecretAmazon = string;
 /**
  * The client secret (application password) from your Azure AD app registration. Used to authenticate your application when exchanging authorization codes for tokens.
  */
 export type ConnectionClientSecretAzureAd = string;
-export type ConnectionClientSecretBitbucket = Management.ConnectionClientSecret;
 /**
- * OAuth2.0 client secret for the Exact Online connection, obtained when registering your application in the Exact App Center.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
+ */
+export type ConnectionClientSecretBitbucket = string;
+/**
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretExact = Management.ConnectionClientSecret;
+export type ConnectionClientSecretExact = string;
 /**
- * Your Facebook App Secret. You can find this in your [Facebook Developers Console](https://developers.facebook.com/apps) under the App Settings section.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretFacebook = Management.ConnectionClientSecret;
+export type ConnectionClientSecretFacebook = string;
 /**
- * Your Google OAuth 2.0 client secret. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretGoogleApps = Management.ConnectionClientSecret;
+export type ConnectionClientSecretGoogleApps = string;
 /**
  * Your Google OAuth 2.0 client secret. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.
  */
@@ -3164,20 +3200,29 @@ export type ConnectionClientSecretLine = string;
  */
 export type ConnectionClientSecretLinkedin = string;
 /**
- * OAuth 1.0a client secret paired with the consumer key to sign request-token and access-token requests for this connection. Treat as a sensitive credential and supply the exact secret issued by the upstream provider.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
+ */
+export type ConnectionClientSecretOAuth1 = string;
+/**
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
+ */
+export type ConnectionClientSecretOAuth2 = string;
+/**
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretOAuth1 = Management.ConnectionClientSecret;
-export type ConnectionClientSecretOAuth2 = Management.ConnectionClientSecret;
-export type ConnectionClientSecretOidc = Management.ConnectionClientSecret;
+export type ConnectionClientSecretOidc = string;
 /**
- * OAuth 2.0 client secret issued by PayPal during application registration. Leave empty to use Auth0 Dev Keys.
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
-export type ConnectionClientSecretPaypal = Management.ConnectionClientSecret;
+export type ConnectionClientSecretPaypal = string;
 /**
  * The OAuth 2.0 client secret
  */
 export type ConnectionClientSecretSalesforce = string;
-export type ConnectionClientSecretWindowsLive = Management.ConnectionClientSecret;
+/**
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
+ */
+export type ConnectionClientSecretWindowsLive = string;
 export interface ConnectionCommon {
     display_name?: Management.ConnectionDisplayName | undefined;
     enabled_clients?: Management.ConnectionEnabledClients | undefined;
@@ -3323,6 +3368,8 @@ export type ConnectionDomainOkta = string;
 /** Algorithm used for DPoP proof JWT signing. */
 export declare const ConnectionDpopSigningAlgEnum: {
     readonly Es256: "ES256";
+    readonly Es384: "ES384";
+    readonly Es512: "ES512";
     readonly Ed25519: "Ed25519";
 };
 export type ConnectionDpopSigningAlgEnum = (typeof ConnectionDpopSigningAlgEnum)[keyof typeof ConnectionDpopSigningAlgEnum];
@@ -3580,8 +3627,8 @@ export type ConnectionGrantTypesSupported = string[];
  */
 export type ConnectionHandleLoginFromSocialGoogleApps = boolean;
 export type ConnectionHttpsUrlWithHttpFallback = string;
-export type ConnectionHttpsUrlWithHttpFallback2048 = Management.ConnectionHttpsUrlWithHttpFallback;
-export type ConnectionHttpsUrlWithHttpFallback255 = Management.ConnectionHttpsUrlWithHttpFallback;
+export type ConnectionHttpsUrlWithHttpFallback2048 = string;
+export type ConnectionHttpsUrlWithHttpFallback255 = string;
 /**
  * https url of the icon to be shown
  */
@@ -3618,6 +3665,10 @@ export type ConnectionIdTokenEncryptionAlgValuesSupported = string[];
  * JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].
  */
 export type ConnectionIdTokenEncryptionEncValuesSupported = string[];
+/**
+ * Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.
+ */
+export type ConnectionIdTokenSessionExpirySupported = boolean;
 /** Algorithm allowed to verify the ID tokens. */
 export declare const ConnectionIdTokenSignedResponseAlgEnum: {
     readonly Es256: "ES256";
@@ -3729,8 +3780,14 @@ export type ConnectionIpsAd = string[];
  * <code>true</code> promotes to a domain-level connection so that third-party applications can use it. <code>false</code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to <code>false</code>.)
  */
 export type ConnectionIsDomainConnection = boolean;
-export type ConnectionIssuer = Management.ConnectionHttpsUrlWithHttpFallback255;
-export type ConnectionJwksUri = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.
+ */
+export type ConnectionIssuer = string;
+/**
+ * URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.
+ */
+export type ConnectionJwksUri = string;
 export interface ConnectionKey {
     /** The key id of the signing key */
     kid: string;
@@ -3820,8 +3877,14 @@ export type ConnectionNamePrefixTemplate = string;
  * An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)
  */
 export type ConnectionNonPersistentAttrs = string[];
-export type ConnectionOpPolicyUri = Management.ConnectionHttpsUrlWithHttpFallback255;
-export type ConnectionOpTosUri = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.
+ */
+export type ConnectionOpPolicyUri = string;
+/**
+ * URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.
+ */
+export type ConnectionOpTosUri = string;
 /**
  * In order to return options in the response, the `read:connections_options` scope must be present
  */
@@ -4142,6 +4205,7 @@ export interface ConnectionOptionsCommonOidc {
     dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
     issuer?: Management.ConnectionIssuer | undefined;
     jwks_uri?: Management.ConnectionJwksUri | undefined;
@@ -5269,7 +5333,7 @@ export type ConnectionPingFederateBaseUrl = Management.ConnectionPingFederateBas
 /**
  * PingFederate base URL constrained to HTTP/HTTPS with length bounds
  */
-export type ConnectionPingFederateBaseUrlPingFederate = Management.ConnectionHttpsUrlWithHttpFallback;
+export type ConnectionPingFederateBaseUrlPingFederate = string;
 export interface ConnectionProfile {
     id?: Management.ConnectionProfileId | undefined;
     name?: Management.ConnectionProfileName | undefined;
@@ -5411,9 +5475,11 @@ export interface ConnectionPropertiesOptions {
     password_options?: Management.ConnectionPasswordOptions | undefined;
     assertion_decryption_settings?: Management.ConnectionAssertionDecryptionSettings | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
+    dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
     token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
     token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -5460,7 +5526,10 @@ export type ConnectionRealms = string[];
  * The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.
  */
 export type ConnectionRecipientUrlSaml = Management.ConnectionHttpsUrlWithHttpFallback255;
-export type ConnectionRegistrationEndpoint = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration
+ */
+export type ConnectionRegistrationEndpoint = string;
 /**
  * JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.
  */
@@ -6328,7 +6397,10 @@ export interface ConnectionScriptsOAuth2 {
  * When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.
  */
 export type ConnectionSendBackChannelNonce = boolean;
-export type ConnectionServiceDocumentation = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.
+ */
+export type ConnectionServiceDocumentation = string;
 /** When using an external IdP, this flag determines  whether 'name', 'given_name', 'family_name', 'nickname', and 'picture' attributes are updated. In addition, it also determines whether the user is created when user doesnt exist previously. Possible values are 'on_each_login' (default value, it configures the connection to automatically create the user if necessary and update the root attributes from the external IdP with each user login. When this setting is used, root attributes cannot be independently updated), 'on_first_login' (configures the connection to create the user and set the root attributes on first login only, allowing them to be independently updated thereafter), and 'never_on_login' (configures the connection not to create the user and not to set the root attributes from the external IdP, allowing them to be independently updated). */
 export declare const ConnectionSetUserRootAttributesEnum: {
     readonly OnEachLogin: "on_each_login";
@@ -6507,7 +6579,10 @@ export type ConnectionTenantDomainAzureAdOne = string;
  * The Google Workspace primary domain used to identify the organization during authentication.
  */
 export type ConnectionTenantDomainGoogleApps = Management.ConnectionTenantDomain;
-export type ConnectionTenantDomainSaml = Management.ConnectionTenantDomain;
+/**
+ * For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.
+ */
+export type ConnectionTenantDomainSaml = string;
 /**
  * The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.
  */
@@ -6524,7 +6599,10 @@ export type ConnectionThumbprintsAd = Management.ConnectionSha1Thumbprint[];
  * SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.
  */
 export type ConnectionThumbprintsSaml = Management.ConnectionSha1Thumbprint[];
-export type ConnectionTokenEndpoint = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.
+ */
+export type ConnectionTokenEndpoint = string;
 /** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. */
 export declare const ConnectionTokenEndpointAuthMethodEnum: {
     readonly ClientSecretPost: "client_secret_post";
@@ -6674,7 +6752,10 @@ export type ConnectionUserinfoEncryptionAlgValuesSupported = string[];
  * JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].
  */
 export type ConnectionUserinfoEncryptionEncValuesSupported = string[];
-export type ConnectionUserinfoEndpoint = Management.ConnectionHttpsUrlWithHttpFallback255;
+/**
+ * Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.
+ */
+export type ConnectionUserinfoEndpoint = string;
 /**
  * JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.
  */
@@ -6703,6 +6784,15 @@ export type ConnectionWaadProtocolEnumAzureAd = (typeof ConnectionWaadProtocolEn
  * Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
  */
 export type ConnectionsMetadata = Record<string, string | null>;
+/**
+ * Content Security Policy configuration with multi-policy support.
+ */
+export interface ContentSecurityPolicyConfig {
+    /** Whether CSP is enabled. */
+    enabled?: boolean | undefined;
+    policies?: Management.CspPolicies | undefined;
+    reporting_infrastructure?: (Management.CspReportingInfrastructure | null) | undefined;
+}
 export interface CreateActionModuleResponseContent {
     /** The unique ID of the module. */
     id?: string | undefined;
@@ -8461,7 +8551,7 @@ export interface CreatePhoneProviderSendTestResponseContent {
     message?: string | undefined;
 }
 export interface CreatePhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -8481,6 +8571,19 @@ export interface CreatePublicKeyDeviceCredentialResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface CreateRateLimitPolicyResponseContent {
+    /** Unique identifier for the Rate Limit Policy. */
+    id: string;
+    resource: Management.RateLimitPolicyResourceEnum;
+    consumer: Management.RateLimitPolicyConsumerEnum;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector: string;
+    configuration: Management.RateLimitPolicyConfiguration;
+    /** The date and time when the rate limit policy was created. */
+    created_at?: string | undefined;
+    /** The date and time when the rate limit policy was last updated. */
+    updated_at?: string | undefined;
+}
 export interface CreateResourceServerResponseContent {
     /** ID of the API (resource server). */
     id?: string | undefined;
@@ -8693,9 +8796,11 @@ export interface CreateUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
+    multifactor_last_modified?: Management.UserDateSchema | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
     last_login?: Management.UserDateSchema | undefined;
+    last_password_reset?: Management.UserDateSchema | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -8765,6 +8870,79 @@ export interface CredentialId {
     /** Credential ID */
     id: string;
 }
+/**
+ * CSP directives map. Keys are directive names, values are arrays of directive values.
+ */
+export type CspDirectives = Record<string, string[]>;
+export declare const CspFlag: {
+    readonly UpgradeInsecureRequests: "upgrade-insecure-requests";
+    readonly BlockAllMixedContent: "block-all-mixed-content";
+};
+export type CspFlag = (typeof CspFlag)[keyof typeof CspFlag];
+/**
+ * CSP flags (bare directives without values).
+ */
+export type CspFlags = Management.CspFlag[];
+/**
+ * Array of CSP policies (enforcing and/or reporting).
+ */
+export type CspPolicies = Management.CspPolicy[];
+/**
+ * A single CSP policy with mode, directives, flags, and optional reporting.
+ */
+export interface CspPolicy {
+    mode?: Management.CspPolicyMode | undefined;
+    directives?: Management.CspDirectives | undefined;
+    flags?: Management.CspFlags | undefined;
+    reporting?: (Management.CspPolicyReporting | null) | undefined;
+}
+/** Policy mode: enforcing or reporting. */
+export declare const CspPolicyMode: {
+    readonly Enforcing: "enforcing";
+    readonly Reporting: "reporting";
+};
+export type CspPolicyMode = (typeof CspPolicyMode)[keyof typeof CspPolicyMode];
+/**
+ * Per-policy reporting configuration.
+ */
+export interface CspPolicyReporting {
+    /** HTTPS endpoint for CSP violation reports. */
+    report_uri?: string | undefined;
+    /** Report-To group name for modern reporting. */
+    report_to_group?: string | undefined;
+}
+/**
+ * Report-To header configuration.
+ */
+export interface CspReportTo {
+    /** Reporting group identifier. */
+    group?: string | undefined;
+    /** Maximum age in seconds for the Report-To header. */
+    max_age?: number | undefined;
+    endpoints?: Management.CspReportToEndpoints | undefined;
+}
+/**
+ * A single reporting endpoint.
+ */
+export interface CspReportToEndpoint {
+    /** HTTPS URL for the reporting endpoint. */
+    url?: string | undefined;
+}
+/**
+ * Array of reporting endpoints.
+ */
+export type CspReportToEndpoints = Management.CspReportToEndpoint[];
+/**
+ * Reporting-Endpoints header configuration (key-value pairs).
+ */
+export type CspReportingEndpoints = Record<string, string>;
+/**
+ * Global reporting infrastructure configuration.
+ */
+export interface CspReportingInfrastructure {
+    report_to?: (Management.CspReportTo | null) | undefined;
+    reporting_endpoints?: Management.CspReportingEndpoints | undefined;
+}
 export interface CustomDomain {
     /** ID of the custom domain. */
     custom_domain_id: string;
@@ -12843,6 +13021,19 @@ export interface ExpressConfigurationOrNull {
 }
 export interface ExtensibilityEmailProviderCredentials {
 }
+/**
+ * Configure FedCM login settings for New Universal Login
+ */
+export interface FedCmLogin {
+    google?: Management.FedCmLoginGoogle | undefined;
+}
+/**
+ * Google FedCM configuration for this client
+ */
+export interface FedCmLoginGoogle {
+    /** When true, shows the Google FedCM prompt on New Universal Login for this client */
+    is_enabled?: boolean | undefined;
+}
 export interface FederatedConnectionTokenSet {
     id?: string | undefined;
     connection?: string | undefined;
@@ -15850,7 +16041,6 @@ export interface GetBrandingResponseContent {
     favicon_url?: string | undefined;
     /** URL for the logo. Must use HTTPS. */
     logo_url?: string | undefined;
-    identifiers?: Management.BrandingIdentifiers | undefined;
     font?: Management.BrandingFont | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -16665,7 +16855,7 @@ export interface GetOrganizationResponseContent {
  */
 export type GetPartialsResponseContent = Record<string, unknown>;
 export interface GetPhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -16674,6 +16864,19 @@ export interface GetPhoneTemplateResponseContent {
     /** Whether the template is enabled (false) or disabled (true). */
     disabled: boolean;
 }
+export interface GetRateLimitPolicyResponseContent {
+    /** Unique identifier for the Rate Limit Policy. */
+    id: string;
+    resource: Management.RateLimitPolicyResourceEnum;
+    consumer: Management.RateLimitPolicyConsumerEnum;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector: string;
+    configuration: Management.RateLimitPolicyConfiguration;
+    /** The date and time when the rate limit policy was created. */
+    created_at?: string | undefined;
+    /** The date and time when the rate limit policy was last updated. */
+    updated_at?: string | undefined;
+}
 export interface GetRefreshTokenResponseContent {
     /** The ID of the refresh token */
     id?: string | undefined;
@@ -16923,6 +17126,7 @@ export interface GetTenantSettingsResponseContent {
     default_redirection_uri?: string | undefined;
     /** Supported locales for the user interface. */
     enabled_locales?: Management.SupportedLocales[] | undefined;
+    security_headers?: (Management.TenantSettingsNullableSecurityHeaders | null) | undefined;
     session_cookie?: (Management.SessionCookieSchema | null) | undefined;
     sessions?: (Management.TenantSettingsSessions | null) | undefined;
     oidc_logout?: Management.TenantOidcLogoutSettings | undefined;
@@ -16950,7 +17154,10 @@ export interface GetTenantSettingsResponseContent {
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    /** Whether session metadata is included in specific tenant logs (slo, oidc_backchannel_logout_failed, oidc_backchannel_logout_succeeded). */
+    include_session_metadata_in_tenant_logs?: boolean | undefined;
     dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
+    country_codes?: Management.TenantSettingsCountryCodesResponse | undefined;
 }
 export interface GetTokenExchangeProfileResponseContent {
     /** The unique ID of the token exchange profile. */
@@ -17068,9 +17275,11 @@ export interface GetUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
+    multifactor_last_modified?: Management.UserDateSchema | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
     last_login?: Management.UserDateSchema | undefined;
+    last_password_reset?: Management.UserDateSchema | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -17618,6 +17827,11 @@ export interface ListFormsOffsetPaginatedResponseContent {
     total?: number | undefined;
     forms?: Management.FormSummary[] | undefined;
 }
+export interface ListGroupRolesResponseContent {
+    roles: Management.Role[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListGroupsPaginatedResponseContent {
     groups: Management.Group[];
     /** A cursor to be used as the "from" query parameter for the next page of results. */
@@ -17668,11 +17882,31 @@ export interface ListOrganizationDiscoveryDomainsResponseContent {
     next?: string | undefined;
     domains: Management.OrganizationDiscoveryDomain[];
 }
+export interface ListOrganizationGroupRolesResponseContent {
+    roles: Management.Role[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
+export interface ListOrganizationGroupsResponseContent {
+    groups: Management.Group[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListOrganizationInvitationsOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
     invitations?: Management.OrganizationInvitation[] | undefined;
 }
+export interface ListOrganizationMemberEffectiveRolesResponseContent {
+    roles: Management.OrganizationMemberEffectiveRole[];
+    /** Cursor for the next page of results */
+    next?: string | undefined;
+}
+export interface ListOrganizationMemberRoleSourceGroupsResponseContent {
+    groups: Management.Group[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListOrganizationMemberRolesOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -17692,6 +17926,11 @@ export interface ListOrganizationsPaginatedResponseContent {
 export interface ListPhoneTemplatesResponseContent {
     templates?: Management.PhoneTemplate[] | undefined;
 }
+export interface ListRateLimitPoliciesPaginatedResponseContent {
+    rate_limit_policies?: Management.RateLimitPolicy[] | undefined;
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListRefreshTokensPaginatedResponseContent {
     tokens?: Management.RefreshTokenResponseContent[] | undefined;
     /** A cursor to be used as the "from" query parameter for the next page of results. */
@@ -17705,6 +17944,11 @@ export interface ListResourceServerOffsetPaginatedResponseContent {
     total?: number | undefined;
     resource_servers?: Management.ResourceServer[] | undefined;
 }
+export interface ListRoleGroupsResponseContent {
+    groups: Management.Group[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListRolePermissionsOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -17785,6 +18029,23 @@ export interface ListUserConnectedAccountsResponseContent {
     /** The token to retrieve the next page of connected accounts (if there is one) */
     next?: string | undefined;
 }
+export interface ListUserEffectivePermissionRoleSourcesResponseContent {
+    /** Roles with the specified permission assigned to the user, both directly and via groups. */
+    roles: Management.UserEffectivePermissionRoleSourceResponseContent[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
+export interface ListUserEffectivePermissionsResponseContent {
+    /** List of permissions assigned to the user. */
+    permissions: Management.UserEffectivePermissionResponseContent[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
+export interface ListUserEffectiveRolesResponseContent {
+    roles: Management.UserEffectiveRole[];
+    /** Cursor for the next page of results */
+    next?: string | undefined;
+}
 export interface ListUserGrantsOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -17803,6 +18064,11 @@ export interface ListUserPermissionsOffsetPaginatedResponseContent {
     total?: number | undefined;
     permissions?: Management.UserPermissionSchema[] | undefined;
 }
+export interface ListUserRoleSourceGroupsResponseContent {
+    groups: Management.Group[];
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListUserRolesOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -18641,6 +18907,21 @@ export interface OrganizationMember {
     email?: string | undefined;
     roles?: Management.OrganizationMemberRole[] | undefined;
 }
+export interface OrganizationMemberEffectiveRole {
+    /** Role ID */
+    id: string;
+    /** Role name */
+    name: string;
+    /** Role description */
+    description: string;
+    /** Sources of the role assignment (direct or through group membership) */
+    sources: Management.OrganizationMemberEffectiveRoleSource[];
+}
+export declare const OrganizationMemberEffectiveRoleSource: {
+    readonly Direct: "direct";
+    readonly Groups: "groups";
+};
+export type OrganizationMemberEffectiveRoleSource = (typeof OrganizationMemberEffectiveRoleSource)[keyof typeof OrganizationMemberEffectiveRoleSource];
 export interface OrganizationMemberRole {
     /** ID for this role. */
     id?: string | undefined;
@@ -18735,6 +19016,16 @@ export interface PatchClientCredentialResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export type PatchRateLimitPolicyConfigurationRequestContent = {
+    action: "allow";
+} | {
+    action: "block" | "log";
+    limit: number;
+} | {
+    action: "redirect";
+    limit: number;
+    redirect_uri: string;
+};
 export interface PatchSupplementalSignalsResponseContent {
     /** Indicates if incoming Akamai Headers should be processed */
     akamai_enabled?: boolean | undefined;
@@ -18806,7 +19097,7 @@ export interface PhoneProviderSchemaMasked {
     updated_at?: string | undefined;
 }
 export interface PhoneTemplate {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -18950,6 +19241,7 @@ export declare const PromptGroupNameEnum: {
     readonly Captcha: "captcha";
     readonly BruteForceProtection: "brute-force-protection";
     readonly AsyncApprovalFlow: "async-approval-flow";
+    readonly Confirmation: "confirmation";
 };
 export type PromptGroupNameEnum = (typeof PromptGroupNameEnum)[keyof typeof PromptGroupNameEnum];
 /** Language to update. */
@@ -19064,6 +19356,42 @@ export declare const PublicKeyCredentialTypeEnum: {
     readonly PublicKey: "public_key";
 };
 export type PublicKeyCredentialTypeEnum = (typeof PublicKeyCredentialTypeEnum)[keyof typeof PublicKeyCredentialTypeEnum];
+export interface RateLimitPolicy {
+    /** Unique identifier for the Rate Limit Policy. */
+    id: string;
+    resource: Management.RateLimitPolicyResourceEnum;
+    consumer: Management.RateLimitPolicyConsumerEnum;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector: string;
+    configuration: Management.RateLimitPolicyConfiguration;
+    /** The date and time when the rate limit policy was created. */
+    created_at?: string | undefined;
+    /** The date and time when the rate limit policy was last updated. */
+    updated_at?: string | undefined;
+}
+/**
+ * The configuration of the rate limit policy.
+ */
+export type RateLimitPolicyConfiguration = {
+    action: "allow";
+} | {
+    action: "block" | "log";
+    limit: number;
+} | {
+    action: "redirect";
+    limit: number;
+    redirect_uri: string;
+};
+/** The consumer to which the rate limit policy applies. */
+export declare const RateLimitPolicyConsumerEnum: {
+    readonly Client: "client";
+};
+export type RateLimitPolicyConsumerEnum = (typeof RateLimitPolicyConsumerEnum)[keyof typeof RateLimitPolicyConsumerEnum];
+/** The API protected by the Rate Limit Policy. */
+export declare const RateLimitPolicyResourceEnum: {
+    readonly OauthAuthenticationApi: "oauth_authentication_api";
+};
+export type RateLimitPolicyResourceEnum = (typeof RateLimitPolicyResourceEnum)[keyof typeof RateLimitPolicyResourceEnum];
 export type RefreshTokenDate = 
 /**
  * The date and time when the refresh token was created */
@@ -19159,7 +19487,7 @@ export interface RegisterCimdClientResponseContent {
 }
 export type ResetPhoneTemplateRequestContent = unknown;
 export interface ResetPhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -19668,6 +19996,7 @@ export declare const ScreenGroupNameEnum: {
     readonly AsyncApprovalError: "async-approval-error";
     readonly AsyncApprovalAccepted: "async-approval-accepted";
     readonly AsyncApprovalDenied: "async-approval-denied";
+    readonly Confirmation: "confirmation";
     readonly AsyncApprovalWrongUser: "async-approval-wrong-user";
 };
 export type ScreenGroupNameEnum = (typeof ScreenGroupNameEnum)[keyof typeof ScreenGroupNameEnum];
@@ -20330,6 +20659,34 @@ export interface TenantOidcLogoutSettings {
     /** Enable the end_session_endpoint URL in the .well-known discovery configuration */
     rp_logout_end_session_endpoint_discovery?: boolean | undefined;
 }
+/**
+ * Phone country code configuration for identifier input.
+ */
+export interface TenantSettingsCountryCodes {
+    /** Array of ISO 3166-1 alpha-2 country codes. */
+    list?: string[] | undefined;
+    mode?: Management.TenantSettingsCountryCodesMode | undefined;
+}
+/** Whether the list is an allowlist or denylist. */
+export declare const TenantSettingsCountryCodesMode: {
+    readonly Allow: "allow";
+    readonly Deny: "deny";
+};
+export type TenantSettingsCountryCodesMode = (typeof TenantSettingsCountryCodesMode)[keyof typeof TenantSettingsCountryCodesMode];
+/** Whether the list is an allowlist or denylist. */
+export declare const TenantSettingsCountryCodesModeResponse: {
+    readonly Allow: "allow";
+    readonly Deny: "deny";
+};
+export type TenantSettingsCountryCodesModeResponse = (typeof TenantSettingsCountryCodesModeResponse)[keyof typeof TenantSettingsCountryCodesModeResponse];
+/**
+ * Phone country code configuration for identifier input.
+ */
+export interface TenantSettingsCountryCodesResponse {
+    /** Array of ISO 3166-1 alpha-2 country codes. */
+    list?: string[] | undefined;
+    mode?: Management.TenantSettingsCountryCodesModeResponse | undefined;
+}
 /**
  * Device Flow configuration
  */
@@ -20440,6 +20797,13 @@ export interface TenantSettingsMtls {
     /** If true, enables mTLS endpoint aliases */
     enable_endpoint_aliases?: boolean | undefined;
 }
+/**
+ * Security headers configuration for tenant responses.
+ */
+export interface TenantSettingsNullableSecurityHeaders {
+    content_security_policy?: (Management.ContentSecurityPolicyConfig | null) | undefined;
+    x_xss_protection?: (Management.XssProtectionConfig | null) | undefined;
+}
 /**
  * Change Password page customization.
  */
@@ -20765,55 +21129,20 @@ export interface UpdateBrandingFont {
     /** URL for the custom font. The URL must point to a font file and not a stylesheet. Must use HTTPS. */
     url?: (string | null) | undefined;
 }
-/**
- * Identifier input display settings.
- */
-export interface UpdateBrandingIdentifiers {
-    login_display?: Management.UpdateBrandingLoginDisplayEnum | undefined;
-    /** Whether OTP autocomplete (autocomplete="one-time-code") is enabled. */
-    otp_autocomplete?: boolean | undefined;
-    phone_display?: (Management.UpdateBrandingPhoneDisplay | null) | undefined;
-}
-/** Controls identifier input presentation on the login flow. Defaults to "unified" for legacy tenants, "separate" for tenants created post-GA of this feature. */
-export declare const UpdateBrandingLoginDisplayEnum: {
-    readonly Unified: "unified";
-    readonly Separate: "separate";
-};
-export type UpdateBrandingLoginDisplayEnum = (typeof UpdateBrandingLoginDisplayEnum)[keyof typeof UpdateBrandingLoginDisplayEnum];
 /**
  * Page Background Color or Gradient.
- * Property contains either <code>null</code> to unset, a solid color as a string value <code>#FFFFFF</code>, or a gradient as an object.
+ * Property contains either `null` to unset, a solid color as a string value `#FFFFFF`, or a gradient as an object.
  *
- * <pre><code>
+ * ```js
  * {
  *   type: 'linear-gradient',
  *   start: '#FFFFFF',
  *   end: '#000000',
  *   angle_deg: 35
  * }
- * </code></pre>
+ * ```
  */
 export type UpdateBrandingPageBackground = (string | null) | undefined | (Record<string, unknown> | null) | undefined;
-/**
- * Phone number display settings.
- */
-export interface UpdateBrandingPhoneDisplay {
-    masking: Management.UpdateBrandingPhoneMaskingEnum;
-    formatting: Management.UpdateBrandingPhoneFormattingEnum;
-}
-/** Controls the format used when displaying phone numbers. */
-export declare const UpdateBrandingPhoneFormattingEnum: {
-    readonly Regional: "regional";
-    readonly International: "international";
-};
-export type UpdateBrandingPhoneFormattingEnum = (typeof UpdateBrandingPhoneFormattingEnum)[keyof typeof UpdateBrandingPhoneFormattingEnum];
-/** Controls how phone numbers are masked when displayed back to users. */
-export declare const UpdateBrandingPhoneMaskingEnum: {
-    readonly ShowAll: "show_all";
-    readonly HideCountryCode: "hide_country_code";
-    readonly MaskDigits: "mask_digits";
-};
-export type UpdateBrandingPhoneMaskingEnum = (typeof UpdateBrandingPhoneMaskingEnum)[keyof typeof UpdateBrandingPhoneMaskingEnum];
 /**
  * Phone provider configuration schema
  */
@@ -20837,7 +21166,6 @@ export interface UpdateBrandingResponseContent {
     favicon_url?: string | undefined;
     /** URL for the logo. Must use HTTPS. */
     logo_url?: string | undefined;
-    identifiers?: Management.BrandingIdentifiers | undefined;
     font?: Management.BrandingFont | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -21049,9 +21377,11 @@ export interface UpdateConnectionOptions {
     password_options?: Management.ConnectionPasswordOptions | undefined;
     assertion_decryption_settings?: Management.ConnectionAssertionDecryptionSettings | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
+    dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
     token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
     token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -21696,7 +22026,7 @@ export interface UpdateOrganizationResponseContent {
     [key: string]: any;
 }
 export interface UpdatePhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -21705,6 +22035,19 @@ export interface UpdatePhoneTemplateResponseContent {
     /** Whether the template is enabled (false) or disabled (true). */
     disabled: boolean;
 }
+export interface UpdateRateLimitPolicyResponseContent {
+    /** Unique identifier for the Rate Limit Policy. */
+    id: string;
+    resource: Management.RateLimitPolicyResourceEnum;
+    consumer: Management.RateLimitPolicyConsumerEnum;
+    /** Identifier or category within the consumer to which the policy applies. Supported values: `client_id:<client_id>` to target a specific client by ID, `client_id:<cimd_uri>` to target a CIMD client by URI, `cimd_clients` to target all CIMD clients, `third_party_clients` to target all third-party clients, or `default` to apply the policy to any consumer identifier not otherwise explicitly targeted. */
+    consumer_selector: string;
+    configuration: Management.RateLimitPolicyConfiguration;
+    /** The date and time when the rate limit policy was created. */
+    created_at?: string | undefined;
+    /** The date and time when the rate limit policy was last updated. */
+    updated_at?: string | undefined;
+}
 export interface UpdateRefreshTokenResponseContent {
     /** The ID of the refresh token */
     id?: string | undefined;
@@ -21910,6 +22253,7 @@ export interface UpdateTenantSettingsResponseContent {
     default_redirection_uri?: string | undefined;
     /** Supported locales for the user interface. */
     enabled_locales?: Management.SupportedLocales[] | undefined;
+    security_headers?: (Management.TenantSettingsNullableSecurityHeaders | null) | undefined;
     session_cookie?: (Management.SessionCookieSchema | null) | undefined;
     sessions?: (Management.TenantSettingsSessions | null) | undefined;
     oidc_logout?: Management.TenantOidcLogoutSettings | undefined;
@@ -21937,7 +22281,10 @@ export interface UpdateTenantSettingsResponseContent {
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    /** Whether session metadata is included in specific tenant logs (slo, oidc_backchannel_logout_failed, oidc_backchannel_logout_succeeded). */
+    include_session_metadata_in_tenant_logs?: boolean | undefined;
     dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
+    country_codes?: Management.TenantSettingsCountryCodesResponse | undefined;
 }
 export interface UpdateTokenQuota {
     client_credentials: Management.TokenQuotaClientCredentials;
@@ -22008,9 +22355,11 @@ export interface UpdateUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
+    multifactor_last_modified?: Management.UserDateSchema | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
     last_login?: Management.UserDateSchema | undefined;
+    last_password_reset?: Management.UserDateSchema | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -22248,6 +22597,55 @@ string
 /**
  * Date and time when this user was created (ISO_8601 format). */
  | Record<string, unknown>;
+export interface UserEffectivePermissionResponseContent {
+    /** Resource server (API) identifier that this permission is for. */
+    resource_server_identifier?: string | undefined;
+    /** Name of this permission. */
+    permission_name?: string | undefined;
+    /** Resource server (API) name this permission is for. */
+    resource_server_name?: string | undefined;
+    /** Description of this permission. */
+    description?: string | undefined;
+    /** List of sources where this permission is coming from. */
+    sources?: Management.UserEffectivePermissionSourceEnum[] | undefined;
+}
+/** The source type of a user effective permission roles. */
+export declare const UserEffectivePermissionRoleSourceEnum: {
+    readonly Direct: "direct";
+    readonly Groups: "groups";
+};
+export type UserEffectivePermissionRoleSourceEnum = (typeof UserEffectivePermissionRoleSourceEnum)[keyof typeof UserEffectivePermissionRoleSourceEnum];
+export interface UserEffectivePermissionRoleSourceResponseContent {
+    /** ID for this role. */
+    id?: string | undefined;
+    /** Name of this role. */
+    name?: string | undefined;
+    /** Description of this role. */
+    description?: string | undefined;
+    /** List of sources where this role is coming from. */
+    sources?: Management.UserEffectivePermissionRoleSourceEnum[] | undefined;
+}
+/** The source type of a user effective permission. */
+export declare const UserEffectivePermissionSourceEnum: {
+    readonly Direct: "direct";
+    readonly Roles: "roles";
+};
+export type UserEffectivePermissionSourceEnum = (typeof UserEffectivePermissionSourceEnum)[keyof typeof UserEffectivePermissionSourceEnum];
+export interface UserEffectiveRole {
+    /** Role ID */
+    id: string;
+    /** Role name */
+    name: string;
+    /** Role description */
+    description: string;
+    /** Sources of the role assignment (direct or through group membership) */
+    sources: Management.UserEffectiveRoleSource[];
+}
+export declare const UserEffectiveRoleSource: {
+    readonly Direct: "direct";
+    readonly Groups: "groups";
+};
+export type UserEffectiveRoleSource = (typeof UserEffectiveRoleSource)[keyof typeof UserEffectiveRoleSource];
 /** Authentication method for this enrollment. Can be `authenticator`, `guardian`, `sms`, `webauthn-roaming`, or `webauthn-platform`. */
 export declare const UserEnrollmentAuthMethodEnum: {
     readonly Authenticator: "authenticator";
@@ -22453,9 +22851,11 @@ export interface UserResponseSchema {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
+    multifactor_last_modified?: Management.UserDateSchema | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
     last_login?: Management.UserDateSchema | undefined;
+    last_password_reset?: Management.UserDateSchema | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -22572,3 +22972,18 @@ export declare const X509CertificateCredentialTypeEnum: {
     readonly X509Cert: "x509_cert";
 };
 export type X509CertificateCredentialTypeEnum = (typeof X509CertificateCredentialTypeEnum)[keyof typeof X509CertificateCredentialTypeEnum];
+/**
+ * X-XSS-Protection header configuration (deprecated header, use CSP instead).
+ */
+export interface XssProtectionConfig {
+    /** Whether X-XSS-Protection header is enabled. */
+    enabled?: boolean | undefined;
+    mode?: Management.XssProtectionMode | undefined;
+    /** HTTPS endpoint for X-XSS-Protection violation reports. */
+    report_uri?: string | undefined;
+}
+/** X-XSS-Protection mode: block. */
+export declare const XssProtectionMode: {
+    readonly Block: "block";
+};
+export type XssProtectionMode = (typeof XssProtectionMode)[keyof typeof XssProtectionMode];