auth0 5.11.0 → 5.13.0

package/dist/esm/management/api/types/types.d.mts

@@ -1158,6 +1158,7 @@ export declare const AculContextEnum: {
     readonly UntrustedDataAuthorizationParamsUiLocales: "untrusted_data.authorization_params.ui_locales";
     readonly UserOrganizations: "user.organizations";
     readonly TransactionCustomDomainDomain: "transaction.custom_domain.domain";
+    readonly Experiment: "experiment";
 };
 export type AculContextEnum = (typeof AculContextEnum)[keyof typeof AculContextEnum];
 /**
@@ -1476,21 +1477,6 @@ export interface BrandingFont {
     /** URL for the custom font. The URL must point to a font file and not a stylesheet. Must use HTTPS. */
     url?: string | undefined;
 }
-/**
- * Identifier input display settings.
- */
-export interface BrandingIdentifiers {
-    login_display?: Management.BrandingLoginDisplayEnum | undefined;
-    /** Whether OTP autocomplete (autocomplete="one-time-code") is enabled. */
-    otp_autocomplete?: boolean | undefined;
-    phone_display?: Management.BrandingPhoneDisplay | undefined;
-}
-/** Controls identifier input presentation on the login flow. Defaults to "unified" for legacy tenants, "separate" for tenants created post-GA of this feature. */
-export declare const BrandingLoginDisplayEnum: {
-    readonly Unified: "unified";
-    readonly Separate: "separate";
-};
-export type BrandingLoginDisplayEnum = (typeof BrandingLoginDisplayEnum)[keyof typeof BrandingLoginDisplayEnum];
 /**
  * Page Background Color or Gradient.
  * Property contains either `null` to unset, a solid color as a string value `#FFFFFF`, or a gradient as an object.
@@ -1505,26 +1491,6 @@ export type BrandingLoginDisplayEnum = (typeof BrandingLoginDisplayEnum)[keyof t
  * ```
  */
 export type BrandingPageBackground = (string | null) | undefined | (Record<string, unknown> | null) | undefined;
-/**
- * Phone number display settings.
- */
-export interface BrandingPhoneDisplay {
-    masking?: Management.BrandingPhoneMaskingEnum | undefined;
-    formatting?: Management.BrandingPhoneFormattingEnum | undefined;
-}
-/** Controls the format used when displaying phone numbers. */
-export declare const BrandingPhoneFormattingEnum: {
-    readonly Regional: "regional";
-    readonly International: "international";
-};
-export type BrandingPhoneFormattingEnum = (typeof BrandingPhoneFormattingEnum)[keyof typeof BrandingPhoneFormattingEnum];
-/** Controls how phone numbers are masked when displayed back to users. */
-export declare const BrandingPhoneMaskingEnum: {
-    readonly ShowAll: "show_all";
-    readonly HideCountryCode: "hide_country_code";
-    readonly MaskDigits: "mask_digits";
-};
-export type BrandingPhoneMaskingEnum = (typeof BrandingPhoneMaskingEnum)[keyof typeof BrandingPhoneMaskingEnum];
 export interface BrandingThemeBorders {
     /** Button border radius */
     button_border_radius: number;
@@ -1949,6 +1915,8 @@ export interface Client {
     mobile?: Management.ClientMobile | undefined;
     /** Initiate login uri, must be https */
     initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
     refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
     default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
     organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
@@ -1961,6 +1929,7 @@ export interface Client {
     /** Makes the use of Proof-of-Possession mandatory for this client */
     require_proof_of_possession?: boolean | undefined;
     signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
     compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
     /**
      * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
@@ -2677,6 +2646,8 @@ export interface ClientMyOrganizationPatchConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration related to the My Organization Configuration for the client.
@@ -2689,6 +2660,8 @@ export interface ClientMyOrganizationPostConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration related to the My Organization Configuration for the client.
@@ -2701,6 +2674,8 @@ export interface ClientMyOrganizationResponseConfiguration {
     /** The allowed connection strategies for the My Organization Configuration. */
     allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
     connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
 }
 /**
  * Configuration for OIDC backchannel logout initiators
@@ -2928,6 +2903,20 @@ export declare const ClientTokenExchangeTypeEnum: {
     readonly OnBehalfOfTokenExchange: "on_behalf_of_token_exchange";
 };
 export type ClientTokenExchangeTypeEnum = (typeof ClientTokenExchangeTypeEnum)[keyof typeof ClientTokenExchangeTypeEnum];
+/**
+ * Settings for Token Vault Privileged Access.
+ */
+export interface ClientTokenVaultPrivilegedAccessWithCredentialId {
+    credentials: Management.CredentialId[];
+    ip_allowlist?: Management.TokenVaultPrivilegedAccessIpAllowlistEntry[] | undefined;
+}
+/**
+ * Settings for Token Vault Privileged Access.
+ */
+export interface ClientTokenVaultPrivilegedAccessWithPublicKey {
+    credentials: Management.PublicKeyCredential[];
+    ip_allowlist?: Management.TokenVaultPrivilegedAccessIpAllowlistEntry[] | undefined;
+}
 export interface ConnectedAccount {
     /** The unique identifier for the connected account. */
     id: string;
@@ -3545,6 +3534,7 @@ export interface ConnectionForList {
     metadata?: Management.ConnectionsMetadata | undefined;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurpose | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
 }
 /**
  * Connection to be added to the organization.
@@ -3693,6 +3683,10 @@ export type ConnectionIdTokenEncryptionAlgValuesSupported = string[];
  * JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].
  */
 export type ConnectionIdTokenEncryptionEncValuesSupported = string[];
+/**
+ * Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.
+ */
+export type ConnectionIdTokenSessionExpirySupported = boolean;
 /** Algorithm allowed to verify the ID tokens. */
 export declare const ConnectionIdTokenSignedResponseAlgEnum: {
     readonly Es256: "ES256";
@@ -4229,6 +4223,7 @@ export interface ConnectionOptionsCommonOidc {
     dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
     issuer?: Management.ConnectionIssuer | undefined;
     jwks_uri?: Management.ConnectionJwksUri | undefined;
@@ -5502,6 +5497,7 @@ export interface ConnectionPropertiesOptions {
     token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
     token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
     token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -5998,6 +5994,7 @@ export interface ConnectionResponseContentOidc extends Management.ConnectionResp
     strategy: ConnectionResponseContentOidc.Strategy;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurposeXaa | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     options?: Management.ConnectionOptionsOidc | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -6027,6 +6024,7 @@ export declare namespace ConnectionResponseContentOffice365 {
  */
 export interface ConnectionResponseContentOkta extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
     strategy: ConnectionResponseContentOkta.Strategy;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     options?: Management.ConnectionOptionsOkta | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -6806,6 +6804,15 @@ export type ConnectionWaadProtocolEnumAzureAd = (typeof ConnectionWaadProtocolEn
  * Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
  */
 export type ConnectionsMetadata = Record<string, string | null>;
+/**
+ * Content Security Policy configuration with multi-policy support.
+ */
+export interface ContentSecurityPolicyConfig {
+    /** Whether CSP is enabled. */
+    enabled?: boolean | undefined;
+    policies?: Management.CspPolicies | undefined;
+    reporting_infrastructure?: (Management.CspReportingInfrastructure | null) | undefined;
+}
 export interface CreateActionModuleResponseContent {
     /** The unique ID of the module. */
     id?: string | undefined;
@@ -7000,6 +7007,8 @@ export interface CreateClientResponseContent {
     mobile?: Management.ClientMobile | undefined;
     /** Initiate login uri, must be https */
     initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
     refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
     default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
     organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
@@ -7012,6 +7021,7 @@ export interface CreateClientResponseContent {
     /** Makes the use of Proof-of-Possession mandatory for this client */
     require_proof_of_possession?: boolean | undefined;
     signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
     compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
     /**
      * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
@@ -7458,6 +7468,7 @@ export interface CreateConnectionRequestContentOidc extends Management.CreateCon
     strategy: CreateConnectionRequestContentOidc.Strategy;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurposeXaa | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     options?: Management.ConnectionOptionsOidc | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -7486,6 +7497,7 @@ export declare namespace CreateConnectionRequestContentOffice365 {
  */
 export interface CreateConnectionRequestContentOkta extends Management.CreateConnectionCommon {
     strategy: CreateConnectionRequestContentOkta.Strategy;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     options?: Management.ConnectionOptionsOkta | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -7805,6 +7817,7 @@ export interface CreateConnectionResponseContent {
     metadata?: Management.ConnectionsMetadata | undefined;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurpose | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
 }
 export interface CreateCustomDomainResponseContent {
     /** ID of the custom domain. */
@@ -8564,7 +8577,7 @@ export interface CreatePhoneProviderSendTestResponseContent {
     message?: string | undefined;
 }
 export interface CreatePhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -8795,8 +8808,10 @@ export interface CreateUserResponseContent {
     phone_number?: string | undefined;
     /** Whether this phone number has been verified (true) or not (false). */
     phone_verified?: boolean | undefined;
-    created_at?: Management.UserDateSchema | undefined;
-    updated_at?: Management.UserDateSchema | undefined;
+    /** Date and time when this user was created. */
+    created_at?: string | undefined;
+    /** Date and time when this user was last updated/modified. */
+    updated_at?: string | undefined;
     /** Array of user identity objects when accounts are linked. */
     identities?: Management.UserIdentitySchema[] | undefined;
     app_metadata?: Management.UserAppMetadataSchema | undefined;
@@ -8809,11 +8824,14 @@ export interface CreateUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
-    multifactor_last_modified?: Management.UserDateSchema | undefined;
+    /** Last date and time this user's multi-factor authentication providers were updated. */
+    multifactor_last_modified?: string | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
-    last_login?: Management.UserDateSchema | undefined;
-    last_password_reset?: Management.UserDateSchema | undefined;
+    /** Last date and time this user logged in. */
+    last_login?: string | undefined;
+    /** Last date and time this user had their password reset. */
+    last_password_reset?: string | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -8883,6 +8901,86 @@ export interface CredentialId {
     /** Credential ID */
     id: string;
 }
+/**
+ * Configure the connection to be used as a Requesting Application for Cross App Access.
+ */
+export interface CrossAppAccessRequestingApp {
+    /** Set to `true` to enable the connection as a Requesting Application for Cross App Access. */
+    active: boolean;
+}
+/**
+ * CSP directives map. Keys are directive names, values are arrays of directive values.
+ */
+export type CspDirectives = Record<string, string[]>;
+export declare const CspFlag: {
+    readonly UpgradeInsecureRequests: "upgrade-insecure-requests";
+    readonly BlockAllMixedContent: "block-all-mixed-content";
+};
+export type CspFlag = (typeof CspFlag)[keyof typeof CspFlag];
+/**
+ * CSP flags (bare directives without values).
+ */
+export type CspFlags = Management.CspFlag[];
+/**
+ * Array of CSP policies (enforcing and/or reporting).
+ */
+export type CspPolicies = Management.CspPolicy[];
+/**
+ * A single CSP policy with mode, directives, flags, and optional reporting.
+ */
+export interface CspPolicy {
+    mode?: Management.CspPolicyMode | undefined;
+    directives?: Management.CspDirectives | undefined;
+    flags?: Management.CspFlags | undefined;
+    reporting?: (Management.CspPolicyReporting | null) | undefined;
+}
+/** Policy mode: enforcing or reporting. */
+export declare const CspPolicyMode: {
+    readonly Enforcing: "enforcing";
+    readonly Reporting: "reporting";
+};
+export type CspPolicyMode = (typeof CspPolicyMode)[keyof typeof CspPolicyMode];
+/**
+ * Per-policy reporting configuration.
+ */
+export interface CspPolicyReporting {
+    /** HTTPS endpoint for CSP violation reports. */
+    report_uri?: string | undefined;
+    /** Report-To group name for modern reporting. */
+    report_to_group?: string | undefined;
+}
+/**
+ * Report-To header configuration.
+ */
+export interface CspReportTo {
+    /** Reporting group identifier. */
+    group?: string | undefined;
+    /** Maximum age in seconds for the Report-To header. */
+    max_age?: number | undefined;
+    endpoints?: Management.CspReportToEndpoints | undefined;
+}
+/**
+ * A single reporting endpoint.
+ */
+export interface CspReportToEndpoint {
+    /** HTTPS URL for the reporting endpoint. */
+    url?: string | undefined;
+}
+/**
+ * Array of reporting endpoints.
+ */
+export type CspReportToEndpoints = Management.CspReportToEndpoint[];
+/**
+ * Reporting-Endpoints header configuration (key-value pairs).
+ */
+export type CspReportingEndpoints = Record<string, string>;
+/**
+ * Global reporting infrastructure configuration.
+ */
+export interface CspReportingInfrastructure {
+    report_to?: (Management.CspReportTo | null) | undefined;
+    reporting_endpoints?: Management.CspReportingEndpoints | undefined;
+}
 export interface CustomDomain {
     /** ID of the custom domain. */
     custom_domain_id: string;
@@ -9056,7 +9154,7 @@ export interface DeleteUserIdentityResponseContentItem {
     /** The name of the connection for the identity. */
     connection: string;
     /** The unique identifier for the user for the identity. */
-    user_id: string;
+    user_id: Management.UserId;
     /** The type of identity provider. */
     provider: string;
     /** <code>true</code> if the identity provider is a social provider, <code>false</code>s otherwise */
@@ -9348,10 +9446,11 @@ export type EmailSparkPostRegionEnum = (typeof EmailSparkPostRegionEnum)[keyof t
  * Specific provider setting
  */
 export type EmailSpecificProviderSettingsWithAdditionalProperties = (Record<string, unknown> | null) | undefined;
-/** Template name. Can be `verify_email`, `verify_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy). */
+/** Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy). */
 export declare const EmailTemplateNameEnum: {
     readonly VerifyEmail: "verify_email";
     readonly VerifyEmailByCode: "verify_email_by_code";
+    readonly AuthEmailByCode: "auth_email_by_code";
     readonly ResetEmail: "reset_email";
     readonly ResetEmailByCode: "reset_email_by_code";
     readonly WelcomeEmail: "welcome_email";
@@ -12974,6 +13073,19 @@ export interface FedCmLoginGoogle {
     /** When true, shows the Google FedCM prompt on New Universal Login for this client */
     is_enabled?: boolean | undefined;
 }
+/**
+ * Google FedCM configuration for this client
+ */
+export interface FedCmLoginGooglePatch {
+    /** When true, shows the Google FedCM prompt on New Universal Login for this client */
+    is_enabled?: boolean | undefined;
+}
+/**
+ * Configure FedCM login settings for New Universal Login
+ */
+export interface FedCmLoginPatch {
+    google?: (Management.FedCmLoginGooglePatch | null) | undefined;
+}
 export interface FederatedConnectionTokenSet {
     id?: string | undefined;
     connection?: string | undefined;
@@ -15981,7 +16093,6 @@ export interface GetBrandingResponseContent {
     favicon_url?: string | undefined;
     /** URL for the logo. Must use HTTPS. */
     logo_url?: string | undefined;
-    identifiers?: Management.BrandingIdentifiers | undefined;
     font?: Management.BrandingFont | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -16133,6 +16244,8 @@ export interface GetClientResponseContent {
     mobile?: Management.ClientMobile | undefined;
     /** Initiate login uri, must be https */
     initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
     refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
     default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
     organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
@@ -16145,6 +16258,7 @@ export interface GetClientResponseContent {
     /** Makes the use of Proof-of-Possession mandatory for this client */
     require_proof_of_possession?: boolean | undefined;
     signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
     compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
     /**
      * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
@@ -16217,6 +16331,7 @@ export interface GetConnectionResponseContent {
     metadata?: Management.ConnectionsMetadata | undefined;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurpose | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
 }
 export interface GetCustomDomainResponseContent {
     /** ID of the custom domain. */
@@ -16795,8 +16910,13 @@ export interface GetOrganizationResponseContent {
  * An object containing template partials for a group of screens.
  */
 export type GetPartialsResponseContent = Record<string, unknown>;
+export interface GetPhoneProviderProtectionResponseContent {
+    type: Management.PhoneProviderProtectionBackoffStrategyEnum;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export interface GetPhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -17067,6 +17187,7 @@ export interface GetTenantSettingsResponseContent {
     default_redirection_uri?: string | undefined;
     /** Supported locales for the user interface. */
     enabled_locales?: Management.SupportedLocales[] | undefined;
+    security_headers?: (Management.TenantSettingsNullableSecurityHeaders | null) | undefined;
     session_cookie?: (Management.SessionCookieSchema | null) | undefined;
     sessions?: (Management.TenantSettingsSessions | null) | undefined;
     oidc_logout?: Management.TenantOidcLogoutSettings | undefined;
@@ -17094,6 +17215,8 @@ export interface GetTenantSettingsResponseContent {
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    /** Whether session metadata is included in specific tenant logs (slo, oidc_backchannel_logout_failed, oidc_backchannel_logout_succeeded). */
+    include_session_metadata_in_tenant_logs?: boolean | undefined;
     dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
     country_codes?: Management.TenantSettingsCountryCodesResponse | undefined;
 }
@@ -17199,8 +17322,10 @@ export interface GetUserResponseContent {
     phone_number?: string | undefined;
     /** Whether this phone number has been verified (true) or not (false). */
     phone_verified?: boolean | undefined;
-    created_at?: Management.UserDateSchema | undefined;
-    updated_at?: Management.UserDateSchema | undefined;
+    /** Date and time when this user was created. */
+    created_at?: string | undefined;
+    /** Date and time when this user was last updated/modified. */
+    updated_at?: string | undefined;
     /** Array of user identity objects when accounts are linked. */
     identities?: Management.UserIdentitySchema[] | undefined;
     app_metadata?: Management.UserAppMetadataSchema | undefined;
@@ -17213,11 +17338,14 @@ export interface GetUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
-    multifactor_last_modified?: Management.UserDateSchema | undefined;
+    /** Last date and time this user's multi-factor authentication providers were updated. */
+    multifactor_last_modified?: string | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
-    last_login?: Management.UserDateSchema | undefined;
-    last_password_reset?: Management.UserDateSchema | undefined;
+    /** Last date and time this user logged in. */
+    last_login?: string | undefined;
+    /** Last date and time this user had their password reset. */
+    last_password_reset?: string | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -18594,6 +18722,13 @@ export interface NativeSocialLoginApple {
     /** Determine whether or not to allow signing in natively using an Apple authorization code */
     enabled?: boolean | undefined;
 }
+/**
+ * Native Social Login support for the Apple connection
+ */
+export interface NativeSocialLoginApplePatch {
+    /** Determine whether or not to allow signing in natively using an Apple authorization code */
+    enabled?: boolean | undefined;
+}
 /**
  * Native Social Login support for the Facebook connection
  */
@@ -18601,6 +18736,13 @@ export interface NativeSocialLoginFacebook {
     /** Determine whether or not to allow signing in natively using Facebook */
     enabled?: boolean | undefined;
 }
+/**
+ * Native Social Login support for the Facebook connection
+ */
+export interface NativeSocialLoginFacebookPatch {
+    /** Determine whether or not to allow signing in natively using Facebook */
+    enabled?: boolean | undefined;
+}
 /**
  * Native Social Login support for the google-oauth2 connection
  */
@@ -18608,6 +18750,21 @@ export interface NativeSocialLoginGoogle {
     /** Determine whether or not to allow signing in natively using a Google ID token */
     enabled?: boolean | undefined;
 }
+/**
+ * Native Social Login support for the google-oauth2 connection
+ */
+export interface NativeSocialLoginGooglePatch {
+    /** Determine whether or not to allow signing in natively using a Google ID token */
+    enabled?: boolean | undefined;
+}
+/**
+ * Configure native social settings
+ */
+export interface NativeSocialLoginPatch {
+    apple?: (Management.NativeSocialLoginApplePatch | null) | undefined;
+    facebook?: (Management.NativeSocialLoginFacebookPatch | null) | undefined;
+    google?: (Management.NativeSocialLoginGooglePatch | null) | undefined;
+}
 export type NetworkAclMatchConnectingIpv4Cidr = string;
 export type NetworkAclMatchConnectingIpv6Cidr = string;
 export type NetworkAclMatchIpv4Cidr = string;
@@ -18954,6 +19111,11 @@ export interface PatchClientCredentialResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface PatchPhoneProviderProtectionResponseContent {
+    type: Management.PhoneProviderProtectionBackoffStrategyEnum;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export type PatchRateLimitPolicyConfigurationRequestContent = {
     action: "allow";
 } | {
@@ -19017,6 +19179,12 @@ export declare const PhoneProviderNameEnum: {
     readonly Custom: "custom";
 };
 export type PhoneProviderNameEnum = (typeof PhoneProviderNameEnum)[keyof typeof PhoneProviderNameEnum];
+/** The type of backoff strategy to use. */
+export declare const PhoneProviderProtectionBackoffStrategyEnum: {
+    readonly Exponential: "exponential";
+    readonly None: "none";
+};
+export type PhoneProviderProtectionBackoffStrategyEnum = (typeof PhoneProviderProtectionBackoffStrategyEnum)[keyof typeof PhoneProviderProtectionBackoffStrategyEnum];
 /**
  * Phone provider configuration schema
  */
@@ -19035,7 +19203,7 @@ export interface PhoneProviderSchemaMasked {
     updated_at?: string | undefined;
 }
 export interface PhoneTemplate {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -19179,6 +19347,7 @@ export declare const PromptGroupNameEnum: {
     readonly Captcha: "captcha";
     readonly BruteForceProtection: "brute-force-protection";
     readonly AsyncApprovalFlow: "async-approval-flow";
+    readonly Confirmation: "confirmation";
 };
 export type PromptGroupNameEnum = (typeof PromptGroupNameEnum)[keyof typeof PromptGroupNameEnum];
 /** Language to update. */
@@ -19424,7 +19593,7 @@ export interface RegisterCimdClientResponseContent {
 }
 export type ResetPhoneTemplateRequestContent = unknown;
 export interface ResetPhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -19702,6 +19871,8 @@ export interface RotateClientSecretResponseContent {
     mobile?: Management.ClientMobile | undefined;
     /** Initiate login uri, must be https */
     initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
     refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
     default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
     organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
@@ -19714,6 +19885,7 @@ export interface RotateClientSecretResponseContent {
     /** Makes the use of Proof-of-Possession mandatory for this client */
     require_proof_of_possession?: boolean | undefined;
     signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
     compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
     /**
      * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
@@ -19933,6 +20105,7 @@ export declare const ScreenGroupNameEnum: {
     readonly AsyncApprovalError: "async-approval-error";
     readonly AsyncApprovalAccepted: "async-approval-accepted";
     readonly AsyncApprovalDenied: "async-approval-denied";
+    readonly Confirmation: "confirmation";
     readonly AsyncApprovalWrongUser: "async-approval-wrong-user";
 };
 export type ScreenGroupNameEnum = (typeof ScreenGroupNameEnum)[keyof typeof ScreenGroupNameEnum];
@@ -20733,6 +20906,13 @@ export interface TenantSettingsMtls {
     /** If true, enables mTLS endpoint aliases */
     enable_endpoint_aliases?: boolean | undefined;
 }
+/**
+ * Security headers configuration for tenant responses.
+ */
+export interface TenantSettingsNullableSecurityHeaders {
+    content_security_policy?: (Management.ContentSecurityPolicyConfig | null) | undefined;
+    x_xss_protection?: (Management.XssProtectionConfig | null) | undefined;
+}
 /**
  * Change Password page customization.
  */
@@ -20902,6 +21082,7 @@ export interface TokenQuotaConfiguration {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export type TokenVaultPrivilegedAccessIpAllowlistEntry = string;
 /**
  * Too Many Requests
  */
@@ -21058,21 +21239,6 @@ export interface UpdateBrandingFont {
     /** URL for the custom font. The URL must point to a font file and not a stylesheet. Must use HTTPS. */
     url?: (string | null) | undefined;
 }
-/**
- * Identifier input display settings.
- */
-export interface UpdateBrandingIdentifiers {
-    login_display?: Management.UpdateBrandingLoginDisplayEnum | undefined;
-    /** Whether OTP autocomplete (autocomplete="one-time-code") is enabled. */
-    otp_autocomplete?: boolean | undefined;
-    phone_display?: (Management.UpdateBrandingPhoneDisplay | null) | undefined;
-}
-/** Controls identifier input presentation on the login flow. Defaults to "unified" for legacy tenants, "separate" for tenants created post-GA of this feature. */
-export declare const UpdateBrandingLoginDisplayEnum: {
-    readonly Unified: "unified";
-    readonly Separate: "separate";
-};
-export type UpdateBrandingLoginDisplayEnum = (typeof UpdateBrandingLoginDisplayEnum)[keyof typeof UpdateBrandingLoginDisplayEnum];
 /**
  * Page Background Color or Gradient.
  * Property contains either `null` to unset, a solid color as a string value `#FFFFFF`, or a gradient as an object.
@@ -21087,26 +21253,6 @@ export type UpdateBrandingLoginDisplayEnum = (typeof UpdateBrandingLoginDisplayE
  * ```
  */
 export type UpdateBrandingPageBackground = (string | null) | undefined | (Record<string, unknown> | null) | undefined;
-/**
- * Phone number display settings.
- */
-export interface UpdateBrandingPhoneDisplay {
-    masking: Management.UpdateBrandingPhoneMaskingEnum;
-    formatting: Management.UpdateBrandingPhoneFormattingEnum;
-}
-/** Controls the format used when displaying phone numbers. */
-export declare const UpdateBrandingPhoneFormattingEnum: {
-    readonly Regional: "regional";
-    readonly International: "international";
-};
-export type UpdateBrandingPhoneFormattingEnum = (typeof UpdateBrandingPhoneFormattingEnum)[keyof typeof UpdateBrandingPhoneFormattingEnum];
-/** Controls how phone numbers are masked when displayed back to users. */
-export declare const UpdateBrandingPhoneMaskingEnum: {
-    readonly ShowAll: "show_all";
-    readonly HideCountryCode: "hide_country_code";
-    readonly MaskDigits: "mask_digits";
-};
-export type UpdateBrandingPhoneMaskingEnum = (typeof UpdateBrandingPhoneMaskingEnum)[keyof typeof UpdateBrandingPhoneMaskingEnum];
 /**
  * Phone provider configuration schema
  */
@@ -21130,7 +21276,6 @@ export interface UpdateBrandingResponseContent {
     favicon_url?: string | undefined;
     /** URL for the logo. Must use HTTPS. */
     logo_url?: string | undefined;
-    identifiers?: Management.BrandingIdentifiers | undefined;
     font?: Management.BrandingFont | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -21260,6 +21405,8 @@ export interface UpdateClientResponseContent {
     mobile?: Management.ClientMobile | undefined;
     /** Initiate login uri, must be https */
     initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
     refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
     default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
     organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
@@ -21272,6 +21419,7 @@ export interface UpdateClientResponseContent {
     /** Makes the use of Proof-of-Possession mandatory for this client */
     require_proof_of_possession?: boolean | undefined;
     signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
     compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
     /**
      * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
@@ -21346,6 +21494,7 @@ export interface UpdateConnectionOptions {
     token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
     token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
     token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined;
+    id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -21550,6 +21699,7 @@ export interface UpdateConnectionRequestContentOidc extends Management.Connectio
     options?: Management.ConnectionOptionsOidc | undefined;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurposeXaa | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
 /**
@@ -21563,6 +21713,7 @@ export interface UpdateConnectionRequestContentOffice365 extends Management.Conn
  * Update a connection with strategy=okta
  */
 export interface UpdateConnectionRequestContentOkta extends Management.ConnectionCommon {
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     options?: Management.ConnectionOptionsOkta | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -21722,6 +21873,7 @@ export interface UpdateConnectionResponseContent {
     metadata?: Management.ConnectionsMetadata | undefined;
     authentication?: Management.ConnectionAuthenticationPurpose | undefined;
     connected_accounts?: Management.ConnectionConnectedAccountsPurpose | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
 }
 export interface UpdateCustomDomainResponseContent {
     /** ID of the custom domain. */
@@ -21990,7 +22142,7 @@ export interface UpdateOrganizationResponseContent {
     [key: string]: any;
 }
 export interface UpdatePhoneTemplateResponseContent {
-    id: string;
+    id?: string | undefined;
     channel?: string | undefined;
     customizable?: boolean | undefined;
     tenant?: string | undefined;
@@ -22217,6 +22369,7 @@ export interface UpdateTenantSettingsResponseContent {
     default_redirection_uri?: string | undefined;
     /** Supported locales for the user interface. */
     enabled_locales?: Management.SupportedLocales[] | undefined;
+    security_headers?: (Management.TenantSettingsNullableSecurityHeaders | null) | undefined;
     session_cookie?: (Management.SessionCookieSchema | null) | undefined;
     sessions?: (Management.TenantSettingsSessions | null) | undefined;
     oidc_logout?: Management.TenantOidcLogoutSettings | undefined;
@@ -22244,6 +22397,8 @@ export interface UpdateTenantSettingsResponseContent {
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    /** Whether session metadata is included in specific tenant logs (slo, oidc_backchannel_logout_failed, oidc_backchannel_logout_succeeded). */
+    include_session_metadata_in_tenant_logs?: boolean | undefined;
     dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
     country_codes?: Management.TenantSettingsCountryCodesResponse | undefined;
 }
@@ -22302,8 +22457,10 @@ export interface UpdateUserResponseContent {
     phone_number?: string | undefined;
     /** Whether this phone number has been verified (true) or not (false). */
     phone_verified?: boolean | undefined;
-    created_at?: Management.UserDateSchema | undefined;
-    updated_at?: Management.UserDateSchema | undefined;
+    /** Date and time when this user was created. */
+    created_at?: string | undefined;
+    /** Date and time when this user was last updated/modified. */
+    updated_at?: string | undefined;
     /** Array of user identity objects when accounts are linked. */
     identities?: Management.UserIdentitySchema[] | undefined;
     app_metadata?: Management.UserAppMetadataSchema | undefined;
@@ -22316,11 +22473,14 @@ export interface UpdateUserResponseContent {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
-    multifactor_last_modified?: Management.UserDateSchema | undefined;
+    /** Last date and time this user's multi-factor authentication providers were updated. */
+    multifactor_last_modified?: string | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
-    last_login?: Management.UserDateSchema | undefined;
-    last_password_reset?: Management.UserDateSchema | undefined;
+    /** Last date and time this user logged in. */
+    last_login?: string | undefined;
+    /** Last date and time this user had their password reset. */
+    last_password_reset?: string | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -22551,13 +22711,6 @@ export interface UserBlockIdentifier {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-export type UserDateSchema = 
-/**
- * Date and time when this user was created (ISO_8601 format). */
-string
-/**
- * Date and time when this user was created (ISO_8601 format). */
- | Record<string, unknown>;
 export interface UserEffectivePermissionResponseContent {
     /** Resource server (API) identifier that this permission is for. */
     resource_server_identifier?: string | undefined;
@@ -22639,7 +22792,7 @@ export interface UserGroupsResponseSchema extends Management.Group {
     membership_created_at?: string | undefined;
 }
 /**
- * user_id of the secondary user account being linked.
+ * Unique identifier of the user for this identity.
  */
 export type UserId = string | number;
 export interface UserIdentity {
@@ -22721,8 +22874,7 @@ export type UserIdentityProviderEnum = (typeof UserIdentityProviderEnum)[keyof t
 export interface UserIdentitySchema {
     /** Name of the connection containing this identity. */
     connection?: string | undefined;
-    /** Unique identifier of the user user for this identity. */
-    user_id?: string | undefined;
+    user_id?: Management.UserId | undefined;
     provider?: Management.UserIdentityProviderEnum | undefined;
     /** Whether this identity is from a social provider (true) or not (false). */
     isSocial?: boolean | undefined;
@@ -22798,8 +22950,10 @@ export interface UserResponseSchema {
     phone_number?: string | undefined;
     /** Whether this phone number has been verified (true) or not (false). */
     phone_verified?: boolean | undefined;
-    created_at?: Management.UserDateSchema | undefined;
-    updated_at?: Management.UserDateSchema | undefined;
+    /** Date and time when this user was created. */
+    created_at?: string | undefined;
+    /** Date and time when this user was last updated/modified. */
+    updated_at?: string | undefined;
     /** Array of user identity objects when accounts are linked. */
     identities?: Management.UserIdentitySchema[] | undefined;
     app_metadata?: Management.UserAppMetadataSchema | undefined;
@@ -22812,11 +22966,14 @@ export interface UserResponseSchema {
     nickname?: string | undefined;
     /** List of multi-factor authentication providers with which this user has enrolled. */
     multifactor?: string[] | undefined;
-    multifactor_last_modified?: Management.UserDateSchema | undefined;
+    /** Last date and time this user's multi-factor authentication providers were updated. */
+    multifactor_last_modified?: string | undefined;
     /** Last IP address from which this user logged in. */
     last_ip?: string | undefined;
-    last_login?: Management.UserDateSchema | undefined;
-    last_password_reset?: Management.UserDateSchema | undefined;
+    /** Last date and time this user logged in. */
+    last_login?: string | undefined;
+    /** Last date and time this user had their password reset. */
+    last_password_reset?: string | undefined;
     /** Total number of logins this user has performed. */
     logins_count?: number | undefined;
     /** Whether this user was blocked by an administrator (true) or is not (false). */
@@ -22933,3 +23090,18 @@ export declare const X509CertificateCredentialTypeEnum: {
     readonly X509Cert: "x509_cert";
 };
 export type X509CertificateCredentialTypeEnum = (typeof X509CertificateCredentialTypeEnum)[keyof typeof X509CertificateCredentialTypeEnum];
+/**
+ * X-XSS-Protection header configuration (deprecated header, use CSP instead).
+ */
+export interface XssProtectionConfig {
+    /** Whether X-XSS-Protection header is enabled. */
+    enabled?: boolean | undefined;
+    mode?: Management.XssProtectionMode | undefined;
+    /** HTTPS endpoint for X-XSS-Protection violation reports. */
+    report_uri?: string | undefined;
+}
+/** X-XSS-Protection mode: block. */
+export declare const XssProtectionMode: {
+    readonly Block: "block";
+};
+export type XssProtectionMode = (typeof XssProtectionMode)[keyof typeof XssProtectionMode];