auth0 5.5.0 → 5.6.0

package/dist/cjs/management/api/types/types.d.ts

@@ -297,6 +297,9 @@ export declare const OauthScope: {
     /**
      * Read Groups */
     readonly ReadGroups: "read:groups";
+    /**
+     * Delete Groups */
+    readonly DeleteGroups: "delete:groups";
     /**
      * Create Guardian Enrollment Tickets */
     readonly CreateGuardianEnrollmentTickets: "create:guardian_enrollment_tickets";
@@ -970,10 +973,24 @@ export interface ActionTriggerCompatibleTrigger {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * An actions extensibility point.
- */
-export type ActionTriggerTypeEnum = string;
+/** An actions extensibility point. */
+export declare const ActionTriggerTypeEnum: {
+    readonly PostLogin: "post-login";
+    readonly CredentialsExchange: "credentials-exchange";
+    readonly PreUserRegistration: "pre-user-registration";
+    readonly PostUserRegistration: "post-user-registration";
+    readonly PostChangePassword: "post-change-password";
+    readonly SendPhoneMessage: "send-phone-message";
+    readonly CustomPhoneProvider: "custom-phone-provider";
+    readonly CustomEmailProvider: "custom-email-provider";
+    readonly PasswordResetPostChallenge: "password-reset-post-challenge";
+    readonly CustomTokenExchange: "custom-token-exchange";
+    readonly EventStream: "event-stream";
+    readonly PasswordHashMigration: "password-hash-migration";
+    readonly LoginPostIdentifier: "login-post-identifier";
+    readonly SignupPostIdentifier: "signup-post-identifier";
+};
+export type ActionTriggerTypeEnum = (typeof ActionTriggerTypeEnum)[keyof typeof ActionTriggerTypeEnum];
 export interface ActionVersion {
     /** The unique id of an action version. */
     id?: string | undefined;
@@ -1047,13 +1064,13 @@ export interface AculConfigsItem {
     screen: Management.ScreenGroupNameEnum;
     /** Rendering mode */
     rendering_mode?: Management.AculRenderingModeEnum | undefined;
-    context_configuration?: Management.AculContextConfiguration | undefined;
+    context_configuration?: ((Management.AculContextConfiguration | undefined) | null) | undefined;
     /** Override Universal Login default head tags */
     default_head_tags_disabled?: (boolean | null) | undefined;
     /** Use page template with ACUL */
     use_page_template?: (boolean | null) | undefined;
     /** An array of head tags */
-    head_tags?: Management.AculHeadTag[] | undefined;
+    head_tags?: (Management.AculHeadTag[] | null) | undefined;
     filters?: (Management.AculFilters | null) | undefined;
 }
 /**
@@ -1063,7 +1080,7 @@ export type AculConfigs = Management.AculConfigsItem[];
 /**
  * Context values to make available
  */
-export type AculContextConfiguration = Management.AculContextConfigurationItem[];
+export type AculContextConfiguration = (Management.AculContextConfigurationItem[] | null) | undefined;
 export type AculContextConfigurationItem = Management.AculContextEnum
 /**
  * Dynamic authorization param ext key (e.g., `untrusted_data.authorization_params.ext-myKey`) */
@@ -1700,6 +1717,72 @@ export interface ChangePasswordTicketResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Client authentication methods derived from the JWKS document
+ */
+export interface CimdMappedClientAuthenticationMethods {
+    private_key_jwt?: Management.CimdMappedClientAuthenticationMethodsPrivateKeyJwt | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+/**
+ * Private Key JWT authentication configuration
+ */
+export interface CimdMappedClientAuthenticationMethodsPrivateKeyJwt {
+    /** Credentials derived from the JWKS document */
+    credentials: Management.CimdMappedPrivateKeyJwtCredential[];
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+/**
+ * Auth0 client fields mapped from the Client ID Metadata Document
+ */
+export interface CimdMappedClientFields {
+    /** The URL of the Client ID Metadata Document */
+    external_client_id?: string | undefined;
+    /** Client name */
+    name?: string | undefined;
+    /** Application type (e.g., web, native) */
+    app_type?: string | undefined;
+    /** Callback URLs */
+    callbacks?: string[] | undefined;
+    /** Logo URI */
+    logo_uri?: string | undefined;
+    /** Human-readable brief description of this client presentable to the end-user */
+    description?: string | undefined;
+    /** List of grant types */
+    grant_types?: string[] | undefined;
+    /** Token endpoint authentication method */
+    token_endpoint_auth_method?: string | undefined;
+    /** URL for the JSON Web Key Set containing the public keys for private_key_jwt authentication */
+    jwks_uri?: string | undefined;
+    client_authentication_methods?: Management.CimdMappedClientAuthenticationMethods | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+export interface CimdMappedPrivateKeyJwtCredential {
+    /** Type of credential (e.g., public_key) */
+    credential_type: string;
+    /** Key identifier from JWKS or calculated thumbprint */
+    kid: string;
+    /** Algorithm (e.g., RS256, RS384, PS256) */
+    alg: string;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+/**
+ * Validation result for the Client ID Metadata Document
+ */
+export interface CimdValidationResult {
+    /** Whether the metadata document passed validation */
+    valid: boolean;
+    /** Array of validation violation messages (if any) */
+    violations: string[];
+    /** Array of warning messages (if any) */
+    warnings: string[];
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export interface Client {
     /** ID of this client. */
     client_id?: string | undefined;
@@ -1737,7 +1820,7 @@ export interface Client {
     /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
     grant_types?: string[] | undefined;
     jwt_configuration?: Management.ClientJwtConfiguration | undefined;
-    signing_keys?: Management.ClientSigningKeys | undefined;
+    signing_keys?: ((Management.ClientSigningKeys | undefined) | null) | undefined;
     encryption_key?: (Management.ClientEncryptionKey | null) | undefined;
     /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
     sso?: boolean | undefined;
@@ -1790,6 +1873,12 @@ export interface Client {
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -2198,7 +2287,7 @@ export type ClientAppTypeEnum = (typeof ClientAppTypeEnum)[keyof typeof ClientAp
 /**
  * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
  */
-export type ClientAsyncApprovalNotificationsChannelsApiPatchConfiguration = Management.AsyncApprovalNotificationsChannelsEnum[];
+export type ClientAsyncApprovalNotificationsChannelsApiPatchConfiguration = (Management.AsyncApprovalNotificationsChannelsEnum[] | null) | undefined;
 /**
  * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
  */
@@ -2340,6 +2429,17 @@ export interface ClientEncryptionKey {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** Indicates who created the external metadata client. The value <code>admin</code> indicates the client was registered via the Management API. The value <code>client</code> indicates the client was registered dynamically. This field is only present when external_metadata_type is set. */
+export declare const ClientExternalMetadataCreatedByEnum: {
+    readonly Admin: "admin";
+    readonly Client: "client";
+};
+export type ClientExternalMetadataCreatedByEnum = (typeof ClientExternalMetadataCreatedByEnum)[keyof typeof ClientExternalMetadataCreatedByEnum];
+/** Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document. */
+export declare const ClientExternalMetadataTypeEnum: {
+    readonly Cimd: "cimd";
+};
+export type ClientExternalMetadataTypeEnum = (typeof ClientExternalMetadataTypeEnum)[keyof typeof ClientExternalMetadataTypeEnum];
 /**
  * Optional filter on allow_any_organization.
  */
@@ -2535,7 +2635,7 @@ export interface ClientRefreshTokenConfiguration {
     /** Prevents tokens from expiring without use when `true` (takes precedence over `idle_token_lifetime` values) */
     infinite_idle_token_lifetime?: boolean | undefined;
     /** A collection of policies governing multi-resource refresh token exchange (MRRT), defining how refresh tokens can be used across different resource servers */
-    policies?: Management.ClientRefreshTokenPolicy[] | undefined;
+    policies?: (Management.ClientRefreshTokenPolicy[] | null) | undefined;
 }
 export interface ClientRefreshTokenPolicy {
     /** The identifier of the resource server to which the Multi Resource Refresh Token Policy applies */
@@ -2557,7 +2657,7 @@ export interface ClientSessionTransferConfiguration {
     /** Indicates whether revoking the parent Refresh Token that initiated a Native to Web flow and was used to issue a Session Transfer Token should trigger a cascade revocation affecting its dependent child entities. Usually configured in the native application. Default value is `true`, applicable only in Native to Web SSO context. */
     enforce_cascade_revocation?: boolean | undefined;
     /** Indicates whether an app can create a session from a Session Transfer Token received via indicated methods. Can include `cookie` and/or `query`. Usually configured in the web application. Default value is an empty array []. */
-    allowed_authentication_methods?: Management.ClientSessionTransferAllowedAuthenticationMethodsEnum[] | undefined;
+    allowed_authentication_methods?: (Management.ClientSessionTransferAllowedAuthenticationMethodsEnum[] | null) | undefined;
     enforce_device_binding?: Management.ClientSessionTransferDeviceBindingEnum | undefined;
     /** Indicates whether Refresh Tokens are allowed to be issued when authenticating with a Session Transfer Token. Usually configured in the web application. Default value is `false`. */
     allow_refresh_token?: boolean | undefined;
@@ -2600,7 +2700,7 @@ export interface ClientSigningKey {
 /**
  * Signing certificates associated with this client.
  */
-export type ClientSigningKeys = Management.ClientSigningKey[];
+export type ClientSigningKeys = (Management.ClientSigningKey[] | null) | undefined;
 /** Defines the requested authentication method for the token endpoint. Can be `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), or `client_secret_basic` (client uses HTTP Basic). */
 export declare const ClientTokenEndpointAuthMethodEnum: {
     readonly None: "none";
@@ -2698,6 +2798,11 @@ export declare const ConnectionApiBehaviorEnum: {
     readonly Optional: "optional";
 };
 export type ConnectionApiBehaviorEnum = (typeof ConnectionApiBehaviorEnum)[keyof typeof ConnectionApiBehaviorEnum];
+export type ConnectionApiEnableGroups = boolean;
+/**
+ * Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false.
+ */
+export type ConnectionApiEnableGroupsGoogleApps = Management.ConnectionApiEnableGroups;
 export type ConnectionApiEnableUsers = boolean;
 /**
  * Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.
@@ -2776,7 +2881,6 @@ export interface ConnectionAuthenticationPurpose {
     active: boolean;
 }
 export type ConnectionAuthorizationEndpoint = string;
-export type ConnectionAuthorizationEndpointOAuth2 = Management.ConnectionAuthorizationEndpoint;
 /**
  * Base URL override for the Exact Online API endpoint used for OAuth2 authorization and API requests. Defaults to https://start.exactonline.nl.
  */
@@ -3059,12 +3163,6 @@ export type ConnectionDomainGoogleApps = string;
  * Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided
  */
 export type ConnectionDomainOkta = string;
-/** Algorithm used for DPoP proof JWT signing. */
-export declare const ConnectionDpopSigningAlgEnum: {
-    readonly Es256: "ES256";
-    readonly Ed25519: "Ed25519";
-};
-export type ConnectionDpopSigningAlgEnum = (typeof ConnectionDpopSigningAlgEnum)[keyof typeof ConnectionDpopSigningAlgEnum];
 /**
  * JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.
  */
@@ -3127,7 +3225,6 @@ export type ConnectionEnabledDatabaseCustomization = boolean;
  * URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.
  */
 export type ConnectionEndSessionEndpoint = string;
-export type ConnectionEndSessionEndpointOAuth2 = Management.ConnectionEndSessionEndpoint;
 /**
  * The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.
  */
@@ -3406,7 +3503,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly Apple: "apple";
     readonly Dropbox: "dropbox";
     readonly Bitbucket: "bitbucket";
-    readonly Aol: "aol";
     readonly Auth0Oidc: "auth0-oidc";
     readonly Auth0: "auth0";
     readonly Baidu: "baidu";
@@ -3421,7 +3517,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly Exact: "exact";
     readonly Facebook: "facebook";
     readonly Fitbit: "fitbit";
-    readonly Flickr: "flickr";
     readonly Github: "github";
     readonly GoogleApps: "google-apps";
     readonly GoogleOauth2: "google-oauth2";
@@ -3429,7 +3524,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly Ip: "ip";
     readonly Line: "line";
     readonly Linkedin: "linkedin";
-    readonly Miicard: "miicard";
     readonly Oauth1: "oauth1";
     readonly Oauth2: "oauth2";
     readonly Office365: "office365";
@@ -3439,7 +3533,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly PaypalSandbox: "paypal-sandbox";
     readonly Pingfederate: "pingfederate";
     readonly Planningcenter: "planningcenter";
-    readonly Renren: "renren";
     readonly SalesforceCommunity: "salesforce-community";
     readonly SalesforceSandbox: "salesforce-sandbox";
     readonly Salesforce: "salesforce";
@@ -3449,8 +3542,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly Shop: "shop";
     readonly Sms: "sms";
     readonly Soundcloud: "soundcloud";
-    readonly ThecitySandbox: "thecity-sandbox";
-    readonly Thecity: "thecity";
     readonly Thirtysevensignals: "thirtysevensignals";
     readonly Twitter: "twitter";
     readonly Untappd: "untappd";
@@ -3460,7 +3551,6 @@ export declare const ConnectionIdentityProviderEnum: {
     readonly Windowslive: "windowslive";
     readonly Wordpress: "wordpress";
     readonly Yahoo: "yahoo";
-    readonly Yammer: "yammer";
     readonly Yandex: "yandex";
 };
 export type ConnectionIdentityProviderEnum = (typeof ConnectionIdentityProviderEnum)[keyof typeof ConnectionIdentityProviderEnum];
@@ -3618,19 +3708,12 @@ export interface ConnectionOptionsAdfs extends Management.ConnectionOptionsCommo
     signInEndpoint?: Management.ConnectionSignInEndpointAdfs | undefined;
     tenant_domain?: Management.ConnectionTenantDomain | undefined;
     thumbprints?: Management.ConnectionThumbprints | undefined;
-    upstream_params?: ((Management.ConnectionUpstreamParamsAdfs | undefined) | null) | undefined;
+    upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */
     user_id_attribute?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * Options for the 'aol' connection
- */
-export interface ConnectionOptionsAol extends Management.ConnectionOptionsOAuth2Common {
-    /** Accepts any additional properties */
-    [key: string]: any;
-}
 /**
  * Options for the 'amazon' connection
  */
@@ -3694,6 +3777,7 @@ export interface ConnectionOptionsAuth0 extends Management.ConnectionOptionsComm
     password_dictionary?: (Management.ConnectionPasswordDictionaryOptions | null) | undefined;
     password_history?: (Management.ConnectionPasswordHistoryOptions | null) | undefined;
     password_no_personal_info?: (Management.ConnectionPasswordNoPersonalInfoOptions | null) | undefined;
+    password_options?: Management.ConnectionPasswordOptions | undefined;
     precedence?: Management.ConnectionIdentifierPrecedence | undefined;
     realm_fallback?: Management.ConnectionRealmFallback | undefined;
     requires_username?: Management.ConnectionRequiresUsername | undefined;
@@ -3721,7 +3805,7 @@ export interface ConnectionOptionsAzureAd extends Management.ConnectionOptionsCo
     app_id?: string | undefined;
     /** Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication. */
     basic_profile?: boolean | undefined;
-    client_id?: Management.ConnectionClientIdAzureAd | undefined;
+    client_id: Management.ConnectionClientIdAzureAd;
     client_secret?: Management.ConnectionClientSecretAzureAd | undefined;
     domain_aliases?: Management.ConnectionDomainAliasesAzureAd | undefined;
     /** When false, prevents storing the user's Azure AD access token in the Auth0 user profile. When true (default), the access token is persisted for API access. */
@@ -3892,7 +3976,6 @@ export interface ConnectionOptionsCommonOidc {
     client_secret?: Management.ConnectionClientSecretOidc | undefined;
     connection_settings?: Management.ConnectionConnectionSettings | undefined;
     domain_aliases?: Management.ConnectionDomainAliases | undefined;
-    dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
@@ -3903,11 +3986,11 @@ export interface ConnectionOptionsCommonOidc {
     send_back_channel_nonce?: Management.ConnectionSendBackChannelNonce | undefined;
     set_user_root_attributes?: Management.ConnectionSetUserRootAttributesEnum | undefined;
     tenant_domain?: Management.ConnectionTenantDomain | undefined;
-    token_endpoint?: Management.ConnectionTokenEndpointOidc | undefined;
+    token_endpoint?: Management.ConnectionTokenEndpoint | undefined;
     token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
     token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
-    userinfo_endpoint?: Management.ConnectionUserinfoEndpointOidc | undefined;
+    userinfo_endpoint?: Management.ConnectionUserinfoEndpoint | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -4097,13 +4180,6 @@ export interface ConnectionOptionsFitbit extends Management.ConnectionOptionsOAu
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * Options for the 'flickr' connection
- */
-export interface ConnectionOptionsFlickr extends Management.ConnectionOptionsOAuth1Common {
-    /** Accepts any additional properties */
-    [key: string]: any;
-}
 /**
  * Array of custom OAuth 2.0 scopes to request from GitHub during authentication. Use this to request scopes not covered by the predefined scope options.
  */
@@ -4170,6 +4246,7 @@ export interface ConnectionOptionsGoogleApps extends Management.ConnectionOption
     admin_refresh_token?: Management.ConnectionAdminRefreshTokenGoogleApps | undefined;
     /** When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated. */
     allow_setting_login_scopes?: boolean | undefined;
+    api_enable_groups?: Management.ConnectionApiEnableGroupsGoogleApps | undefined;
     api_enable_users?: Management.ConnectionApiEnableUsersGoogleApps | undefined;
     client_id: Management.ConnectionClientIdGoogleApps;
     client_secret?: Management.ConnectionClientSecretGoogleApps | undefined;
@@ -4416,13 +4493,6 @@ export interface ConnectionOptionsLinkedin extends Management.ConnectionOptionsC
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * Options for the 'miicard' connection
- */
-export interface ConnectionOptionsMiicard extends Management.ConnectionOptionsOAuth2Common {
-    /** Accepts any additional properties */
-    [key: string]: any;
-}
 /**
  * Options for the 'oauth1' connection
  */
@@ -4452,19 +4522,19 @@ export interface ConnectionOptionsOAuth1Common extends Management.ConnectionOpti
 export interface ConnectionOptionsOAuth2 extends Management.ConnectionOptionsCommon {
     authParams?: Management.ConnectionAuthParamsOAuth2 | undefined;
     authParamsMap?: Management.ConnectionAuthParamsMap | undefined;
-    authorizationURL?: Management.ConnectionAuthorizationEndpointOAuth2 | undefined;
+    authorizationURL?: Management.ConnectionAuthorizationEndpoint | undefined;
     client_id?: Management.ConnectionClientIdOAuth2 | undefined;
     client_secret?: Management.ConnectionClientSecretOAuth2 | undefined;
     customHeaders?: Management.ConnectionCustomHeadersOAuth2 | undefined;
     fieldsMap?: Management.ConnectionFieldsMap | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
-    logoutUrl?: Management.ConnectionEndSessionEndpointOAuth2 | undefined;
+    logoutUrl?: Management.ConnectionEndSessionEndpoint | undefined;
     /** When true, enables Proof Key for Code Exchange (PKCE) for the authorization code flow. PKCE provides additional security by preventing authorization code interception attacks. */
     pkce_enabled?: boolean | undefined;
     scope?: Management.ConnectionScopeOAuth2 | undefined;
     scripts?: Management.ConnectionScriptsOAuth2 | undefined;
     set_user_root_attributes?: Management.ConnectionSetUserRootAttributesEnum | undefined;
-    tokenURL?: Management.ConnectionTokenEndpointOAuth2 | undefined;
+    tokenURL?: Management.ConnectionTokenEndpoint | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint */
     useOauthSpecScope?: boolean | undefined;
@@ -4593,13 +4663,6 @@ export declare const ConnectionOptionsProtocolEnumTwitter: {
     readonly Oauth2: "oauth2";
 };
 export type ConnectionOptionsProtocolEnumTwitter = (typeof ConnectionOptionsProtocolEnumTwitter)[keyof typeof ConnectionOptionsProtocolEnumTwitter];
-/**
- * Options for the 'renren' connection
- */
-export interface ConnectionOptionsRenren extends Management.ConnectionOptionsOAuth2Common {
-    /** Accepts any additional properties */
-    [key: string]: any;
-}
 /**
  * Options for the 'samlp' connection
  */
@@ -4899,13 +4962,6 @@ export interface ConnectionOptionsYahoo extends Management.ConnectionOptionsOAut
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * Options for the 'yammer' connection
- */
-export interface ConnectionOptionsYammer extends Management.ConnectionOptionsOAuth2Common {
-    /** Accepts any additional properties */
-    [key: string]: any;
-}
 /**
  * Options for the 'yandex' connection
  */
@@ -4974,6 +5030,56 @@ export interface ConnectionPasswordHistoryOptions {
 export interface ConnectionPasswordNoPersonalInfoOptions {
     enable: boolean;
 }
+/**
+ * Password policy options for flexible password policy configuration
+ */
+export interface ConnectionPasswordOptions {
+    complexity?: Management.ConnectionPasswordOptionsComplexity | undefined;
+    dictionary?: Management.ConnectionPasswordOptionsDictionary | undefined;
+    history?: Management.ConnectionPasswordOptionsHistory | undefined;
+    profile_data?: Management.ConnectionPasswordOptionsProfileData | undefined;
+}
+/**
+ * Password complexity requirements configuration
+ */
+export interface ConnectionPasswordOptionsComplexity {
+    /** Minimum password length required (1-72 characters) */
+    min_length?: number | undefined;
+    /** Required character types that must be present in passwords. Valid options: uppercase, lowercase, number, special */
+    character_types?: Management.PasswordCharacterTypeEnum[] | undefined;
+    character_type_rule?: Management.PasswordCharacterTypeRulePolicyEnum | undefined;
+    identical_characters?: Management.PasswordIdenticalCharactersPolicyEnum | undefined;
+    sequential_characters?: Management.PasswordSequentialCharactersPolicyEnum | undefined;
+    max_length_exceeded?: Management.PasswordMaxLengthExceededPolicyEnum | undefined;
+}
+/**
+ * Dictionary-based password restriction policy to prevent common passwords
+ */
+export interface ConnectionPasswordOptionsDictionary {
+    /** Enables dictionary checking to prevent use of common passwords and custom blocked words */
+    active?: boolean | undefined;
+    /** Array of custom words to block in passwords. Maximum 200 items, each up to 50 characters */
+    custom?: string[] | undefined;
+    default?: Management.PasswordDefaultDictionariesEnum | undefined;
+}
+/**
+ * Password history policy configuration to prevent password reuse
+ */
+export interface ConnectionPasswordOptionsHistory {
+    /** Enables password history checking to prevent users from reusing recent passwords */
+    active?: boolean | undefined;
+    /** Number of previous passwords to remember and prevent reuse (1-24) */
+    size?: number | undefined;
+}
+/**
+ * Personal information restriction policy to prevent use of profile data in passwords
+ */
+export interface ConnectionPasswordOptionsProfileData {
+    /** Prevents users from including profile data (like name, email) in their passwords */
+    active?: boolean | undefined;
+    /** Blocked profile fields. An array of up to 12 entries. */
+    blocked_fields?: string[] | undefined;
+}
 /** Password strength level */
 export declare const ConnectionPasswordPolicyEnum: {
     readonly None: "none";
@@ -5102,7 +5208,7 @@ export interface ConnectionProfileTemplateItem {
 export interface ConnectionPropertiesOptions {
     validation?: (Management.ConnectionValidationOptions | null) | undefined;
     /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */
-    non_persistent_attrs?: string[] | undefined;
+    non_persistent_attrs?: (string[] | null) | undefined;
     /** Order of precedence for attribute types. If the property is not specified, the default precedence of attributes will be used. */
     precedence?: Management.ConnectionIdentifierPrecedenceEnum[] | undefined;
     attributes?: Management.ConnectionAttributes | undefined;
@@ -5112,6 +5218,8 @@ export interface ConnectionPropertiesOptions {
     enabledDatabaseCustomization?: boolean | undefined;
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
+    /** Stores encrypted string only configurations for connections */
+    configuration?: (Record<string, string | null> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
@@ -5133,6 +5241,7 @@ export interface ConnectionPropertiesOptions {
     set_user_root_attributes?: Management.ConnectionSetUserRootAttributesEnum | undefined;
     gateway_authentication?: (Management.ConnectionGatewayAuthentication | null) | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
+    password_options?: Management.ConnectionPasswordOptions | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -5217,7 +5326,7 @@ export type ConnectionRequireRequestUriRegistration = boolean;
  */
 export type ConnectionRequiresUsername = boolean;
 export interface ConnectionResponseCommon extends Management.CreateConnectionCommon {
-    id?: Management.ConnectionId | undefined;
+    id: Management.ConnectionId;
     realms?: Management.ConnectionRealms | undefined;
 }
 /**
@@ -5249,19 +5358,6 @@ export declare namespace ConnectionResponseContentAdfs {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Response for connections with strategy=aol
- */
-export interface ConnectionResponseContentAol extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
-    strategy: ConnectionResponseContentAol.Strategy;
-    options?: Management.ConnectionOptionsAol | undefined;
-}
-export declare namespace ConnectionResponseContentAol {
-    const Strategy: {
-        readonly Aol: "aol";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Response for connections with strategy=amazon
  */
@@ -5512,19 +5608,6 @@ export declare namespace ConnectionResponseContentFitbit {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Response for connections with strategy=flickr
- */
-export interface ConnectionResponseContentFlickr extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
-    strategy: ConnectionResponseContentFlickr.Strategy;
-    options?: Management.ConnectionOptionsFlickr | undefined;
-}
-export declare namespace ConnectionResponseContentFlickr {
-    const Strategy: {
-        readonly Flickr: "flickr";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Response for connections with strategy=github
  */
@@ -5619,19 +5702,6 @@ export declare namespace ConnectionResponseContentLinkedin {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Response for connections with strategy=miicard
- */
-export interface ConnectionResponseContentMiicard extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
-    strategy: ConnectionResponseContentMiicard.Strategy;
-    options?: Management.ConnectionOptionsMiicard | undefined;
-}
-export declare namespace ConnectionResponseContentMiicard {
-    const Strategy: {
-        readonly Miicard: "miicard";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Response for connections with strategy=oauth1
  */
@@ -5757,19 +5827,6 @@ export declare namespace ConnectionResponseContentPlanningCenter {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Response for connections with strategy=renren
- */
-export interface ConnectionResponseContentRenren extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
-    strategy: ConnectionResponseContentRenren.Strategy;
-    options?: Management.ConnectionOptionsRenren | undefined;
-}
-export declare namespace ConnectionResponseContentRenren {
-    const Strategy: {
-        readonly Renren: "renren";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Response for connections with strategy=samlp
  */
@@ -5994,19 +6051,6 @@ export declare namespace ConnectionResponseContentYahoo {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Response for connections with strategy=yammer
- */
-export interface ConnectionResponseContentYammer extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
-    strategy: ConnectionResponseContentYammer.Strategy;
-    options?: Management.ConnectionOptionsYammer | undefined;
-}
-export declare namespace ConnectionResponseContentYammer {
-    const Strategy: {
-        readonly Yammer: "yammer";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Response for connections with strategy=yandex
  */
@@ -6207,7 +6251,6 @@ export declare const ConnectionStrategyEnum: {
     readonly Apple: "apple";
     readonly Dropbox: "dropbox";
     readonly Bitbucket: "bitbucket";
-    readonly Aol: "aol";
     readonly Auth0Oidc: "auth0-oidc";
     readonly Auth0: "auth0";
     readonly Baidu: "baidu";
@@ -6222,7 +6265,6 @@ export declare const ConnectionStrategyEnum: {
     readonly Exact: "exact";
     readonly Facebook: "facebook";
     readonly Fitbit: "fitbit";
-    readonly Flickr: "flickr";
     readonly Github: "github";
     readonly GoogleApps: "google-apps";
     readonly GoogleOauth2: "google-oauth2";
@@ -6230,7 +6272,6 @@ export declare const ConnectionStrategyEnum: {
     readonly Ip: "ip";
     readonly Line: "line";
     readonly Linkedin: "linkedin";
-    readonly Miicard: "miicard";
     readonly Oauth1: "oauth1";
     readonly Oauth2: "oauth2";
     readonly Office365: "office365";
@@ -6240,7 +6281,6 @@ export declare const ConnectionStrategyEnum: {
     readonly PaypalSandbox: "paypal-sandbox";
     readonly Pingfederate: "pingfederate";
     readonly Planningcenter: "planningcenter";
-    readonly Renren: "renren";
     readonly SalesforceCommunity: "salesforce-community";
     readonly SalesforceSandbox: "salesforce-sandbox";
     readonly Salesforce: "salesforce";
@@ -6250,8 +6290,6 @@ export declare const ConnectionStrategyEnum: {
     readonly Shop: "shop";
     readonly Sms: "sms";
     readonly Soundcloud: "soundcloud";
-    readonly ThecitySandbox: "thecity-sandbox";
-    readonly Thecity: "thecity";
     readonly Thirtysevensignals: "thirtysevensignals";
     readonly Twitter: "twitter";
     readonly Untappd: "untappd";
@@ -6261,7 +6299,6 @@ export declare const ConnectionStrategyEnum: {
     readonly Windowslive: "windowslive";
     readonly Wordpress: "wordpress";
     readonly Yahoo: "yahoo";
-    readonly Yammer: "yammer";
     readonly Yandex: "yandex";
     readonly Auth0Adldap: "auth0-adldap";
 };
@@ -6341,8 +6378,6 @@ export type ConnectionTokenEndpointAuthSigningAlgEnum = (typeof ConnectionTokenE
  * JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.
  */
 export type ConnectionTokenEndpointAuthSigningAlgValuesSupported = string[];
-export type ConnectionTokenEndpointOAuth2 = Management.ConnectionTokenEndpoint;
-export type ConnectionTokenEndpointOidc = Management.ConnectionTokenEndpoint;
 export interface ConnectionTotpEmail {
     length?: Management.ConnectionTotpLengthEmail | undefined;
     time_step?: Management.ConnectionTotpTimeStepEmail | undefined;
@@ -6423,8 +6458,7 @@ export type ConnectionUpstreamAliasEnum = (typeof ConnectionUpstreamAliasEnum)[k
 /**
  * Options for adding parameters in the request to the upstream IdP
  */
-export type ConnectionUpstreamParams = (Record<string, (Management.ConnectionUpstreamAdditionalProperties | null) | undefined> | null) | undefined;
-export type ConnectionUpstreamParamsAdfs = ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
+export type ConnectionUpstreamParams = (Record<string, Management.ConnectionUpstreamAdditionalProperties | null> | null) | undefined;
 /**
  * Options for adding parameters in the request to the upstream IdP. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps
  */
@@ -6463,7 +6497,6 @@ export type ConnectionUserinfoEncryptionAlgValuesSupported = string[];
  */
 export type ConnectionUserinfoEncryptionEncValuesSupported = string[];
 export type ConnectionUserinfoEndpoint = Management.ConnectionHttpsUrlWithHttpFallback255;
-export type ConnectionUserinfoEndpointOidc = Management.ConnectionUserinfoEndpoint;
 /**
  * JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.
  */
@@ -6491,7 +6524,7 @@ export type ConnectionWaadProtocolEnumAzureAd = (typeof ConnectionWaadProtocolEn
 /**
  * Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
  */
-export type ConnectionsMetadata = Record<string, (string | null) | undefined>;
+export type ConnectionsMetadata = Record<string, string | null>;
 export interface CreateActionModuleResponseContent {
     /** The unique ID of the module. */
     id?: string | undefined;
@@ -6659,7 +6692,7 @@ export interface CreateClientResponseContent {
     /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
     grant_types?: string[] | undefined;
     jwt_configuration?: Management.ClientJwtConfiguration | undefined;
-    signing_keys?: Management.ClientSigningKeys | undefined;
+    signing_keys?: ((Management.ClientSigningKeys | undefined) | null) | undefined;
     encryption_key?: (Management.ClientEncryptionKey | null) | undefined;
     /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
     sso?: boolean | undefined;
@@ -6712,11 +6745,22 @@ export interface CreateClientResponseContent {
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
-export interface CreateConnectionCommon extends Management.ConnectionCommon {
-    name?: Management.ConnectionName | undefined;
+export interface CreateConnectionCommon {
+    name: Management.ConnectionName;
+    /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */
+    enabled_clients?: string[] | undefined;
+    display_name?: Management.ConnectionDisplayName | undefined;
+    is_domain_connection?: Management.ConnectionIsDomainConnection | undefined;
+    metadata?: Management.ConnectionsMetadata | undefined;
 }
 export interface CreateConnectionProfileResponseContent {
     id?: Management.ConnectionProfileId | undefined;
@@ -6754,19 +6798,6 @@ export declare namespace CreateConnectionRequestContentAdfs {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Create a connection with strategy=aol
- */
-export interface CreateConnectionRequestContentAol extends Management.CreateConnectionCommon {
-    strategy: CreateConnectionRequestContentAol.Strategy;
-    options?: Management.ConnectionOptionsAol | undefined;
-}
-export declare namespace CreateConnectionRequestContentAol {
-    const Strategy: {
-        readonly Aol: "aol";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Create a connection with strategy=amazon
  */
@@ -7016,19 +7047,6 @@ export declare namespace CreateConnectionRequestContentFitbit {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Create a connection with strategy=flickr
- */
-export interface CreateConnectionRequestContentFlickr extends Management.CreateConnectionCommon {
-    strategy: CreateConnectionRequestContentFlickr.Strategy;
-    options?: Management.ConnectionOptionsFlickr | undefined;
-}
-export declare namespace CreateConnectionRequestContentFlickr {
-    const Strategy: {
-        readonly Flickr: "flickr";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Create a connection with strategy=github
  */
@@ -7122,19 +7140,6 @@ export declare namespace CreateConnectionRequestContentLinkedin {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Create a connection with strategy=miicard
- */
-export interface CreateConnectionRequestContentMiicard extends Management.CreateConnectionCommon {
-    strategy: CreateConnectionRequestContentMiicard.Strategy;
-    options?: Management.ConnectionOptionsMiicard | undefined;
-}
-export declare namespace CreateConnectionRequestContentMiicard {
-    const Strategy: {
-        readonly Miicard: "miicard";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Create a connection with strategy=oauth1
  */
@@ -7258,19 +7263,6 @@ export declare namespace CreateConnectionRequestContentPlanningCenter {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Create a connection with strategy=renren
- */
-export interface CreateConnectionRequestContentRenren extends Management.CreateConnectionCommon {
-    strategy: CreateConnectionRequestContentRenren.Strategy;
-    options?: Management.ConnectionOptionsRenren | undefined;
-}
-export declare namespace CreateConnectionRequestContentRenren {
-    const Strategy: {
-        readonly Renren: "renren";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Create a connection with strategy=samlp
  */
@@ -7494,19 +7486,6 @@ export declare namespace CreateConnectionRequestContentYahoo {
     };
     type Strategy = (typeof Strategy)[keyof typeof Strategy];
 }
-/**
- * Create a connection with strategy=yammer
- */
-export interface CreateConnectionRequestContentYammer extends Management.CreateConnectionCommon {
-    strategy: CreateConnectionRequestContentYammer.Strategy;
-    options?: Management.ConnectionOptionsYammer | undefined;
-}
-export declare namespace CreateConnectionRequestContentYammer {
-    const Strategy: {
-        readonly Yammer: "yammer";
-    };
-    type Strategy = (typeof Strategy)[keyof typeof Strategy];
-}
 /**
  * Create a connection with strategy=yandex
  */
@@ -7568,6 +7547,7 @@ export interface CreateDirectoryProvisioningRequestContent {
     mapping?: Management.DirectoryProvisioningMappingItem[] | undefined;
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically?: boolean | undefined;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
 }
 export interface CreateDirectoryProvisioningResponseContent {
     /** The connection's identifier */
@@ -7580,6 +7560,7 @@ export interface CreateDirectoryProvisioningResponseContent {
     mapping: Management.DirectoryProvisioningMappingItem[];
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically: boolean;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
     /** The timestamp at which the directory provisioning configuration was created */
     created_at: string;
     /** The timestamp at which the directory provisioning configuration was last updated */
@@ -8224,6 +8205,22 @@ export interface CreateLogStreamSumoRequestBody {
     /** The optional datetime (ISO 8601) to start streaming logs from */
     startFrom?: string | undefined;
 }
+export interface CreateOrganizationAllConnectionResponseContent {
+    /** Name of the connection in the scope of this organization. */
+    organization_connection_name?: string | undefined;
+    /** When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection. */
+    assign_membership_on_login?: boolean | undefined;
+    /** Determines whether a connection should be displayed on this organization’s login prompt. Only applicable for enterprise connections. Default: true. */
+    show_as_button?: boolean | undefined;
+    /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
+    is_signup_enabled?: boolean | undefined;
+    organization_access_level?: Management.OrganizationAccessLevelEnum | undefined;
+    /** Whether the connection is enabled for the organization. */
+    is_enabled?: boolean | undefined;
+    /** Connection identifier. */
+    connection_id: string;
+    connection?: Management.OrganizationConnectionInformation | undefined;
+}
 export interface CreateOrganizationDiscoveryDomainResponseContent {
     /** Organization discovery domain identifier. */
     id: string;
@@ -8318,6 +8315,8 @@ export interface CreateResourceServerResponseContent {
     signing_secret?: string | undefined;
     /** Whether refresh tokens can be issued for this API (true) or not (false). */
     allow_offline_access?: boolean | undefined;
+    /** Whether Online Refresh Tokens can be issued for this API (true) or not (false). */
+    allow_online_access?: boolean | undefined;
     /** Whether to skip user consent for applications flagged as first party (true) or not (false). */
     skip_consent_for_verifiable_first_party_clients?: boolean | undefined;
     /** Expiration value (in seconds) for access tokens issued for this API from the token endpoint. */
@@ -8329,7 +8328,7 @@ export interface CreateResourceServerResponseContent {
     token_dialect?: Management.ResourceServerTokenDialectResponseEnum | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
-    authorization_details?: unknown[] | undefined;
+    authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
     /** The client ID of the client that this resource server is linked to */
@@ -8859,6 +8858,7 @@ export interface DirectoryProvisioning {
     mapping: Management.DirectoryProvisioningMappingItem[];
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically: boolean;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
     /** The timestamp at which the directory provisioning configuration was created */
     created_at: string;
     /** The timestamp at which the directory provisioning configuration was last updated */
@@ -8904,7 +8904,7 @@ export type DomainCertificateStatusEnum = (typeof DomainCertificateStatusEnum)[k
 /**
  * Domain metadata associated with the custom domain, in the form of an object with string values (max 255 chars). Maximum of 10 domain metadata properties allowed.
  */
-export type DomainMetadata = Record<string, (string | null) | undefined>;
+export type DomainMetadata = Record<string, string | null>;
 /**
  * Domain verification settings.
  */
@@ -9311,7 +9311,7 @@ export declare const EventStreamTestEventTypeEnum: {
     readonly GroupMemberDeleted: "group.member.deleted";
 };
 export type EventStreamTestEventTypeEnum = (typeof EventStreamTestEventTypeEnum)[keyof typeof EventStreamTestEventTypeEnum];
-export type EventStreamWebhookAuthorizationResponse = Management.EventStreamWebhookBasicAuth | Management.EventStreamWebhookBearerAuth;
+export type EventStreamWebhookAuthorizationResponse = Management.EventStreamWebhookBasicAuth | Management.EventStreamWebhookBearerAuth | Management.EventStreamWebhookCustomHeaderAuth;
 /**
  * Basic Authorization for HTTP requests (e.g., 'Basic credentials').
  */
@@ -9344,6 +9344,19 @@ export interface EventStreamWebhookConfiguration {
     webhook_endpoint: string;
     webhook_authorization: Management.EventStreamWebhookAuthorizationResponse;
 }
+/**
+ * Custom header authorization for HTTP requests.
+ */
+export interface EventStreamWebhookCustomHeaderAuth {
+    method: Management.EventStreamWebhookCustomHeaderAuthMethodEnum;
+    /** HTTP header name. */
+    header_key: string;
+}
+/** Type of authorization. */
+export declare const EventStreamWebhookCustomHeaderAuthMethodEnum: {
+    readonly CustomHeader: "custom_header";
+};
+export type EventStreamWebhookCustomHeaderAuthMethodEnum = (typeof EventStreamWebhookCustomHeaderAuthMethodEnum)[keyof typeof EventStreamWebhookCustomHeaderAuthMethodEnum];
 export interface EventStreamWebhookDestination {
     type: Management.EventStreamWebhookDestinationTypeEnum;
     configuration: Management.EventStreamWebhookConfiguration;
@@ -9704,7 +9717,7 @@ export type FlowActionAuth0SendRequestParamsCustomVars = Record<string, unknown>
 export type FlowActionAuth0SendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionAuth0SendRequestParamsPayload = string | unknown[] | Management.FlowActionAuth0SendRequestParamsPayloadObject;
 export type FlowActionAuth0SendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, (FlowActionAuth0SendRequestParamsQueryParams.Value | null) | undefined>;
+export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, FlowActionAuth0SendRequestParamsQueryParams.Value | null>;
 export declare namespace FlowActionAuth0SendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -10121,7 +10134,7 @@ export interface FlowActionHttpSendRequestParamsBasicAuth {
 export type FlowActionHttpSendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionHttpSendRequestParamsPayload = string | unknown[] | Management.FlowActionHttpSendRequestParamsPayloadObject;
 export type FlowActionHttpSendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionHttpSendRequestParamsQueryParams = Record<string, (FlowActionHttpSendRequestParamsQueryParams.Value | null) | undefined>;
+export type FlowActionHttpSendRequestParamsQueryParams = Record<string, FlowActionHttpSendRequestParamsQueryParams.Value | null>;
 export declare namespace FlowActionHttpSendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -12342,13 +12355,13 @@ export interface GetAculResponseContent {
     screen?: string | undefined;
     /** Rendering mode */
     rendering_mode?: Management.AculRenderingModeEnum | undefined;
-    context_configuration?: Management.AculContextConfiguration | undefined;
+    context_configuration?: ((Management.AculContextConfiguration | undefined) | null) | undefined;
     /** Override Universal Login default head tags */
     default_head_tags_disabled?: (boolean | null) | undefined;
     /** Use page template with ACUL */
     use_page_template?: (boolean | null) | undefined;
     /** An array of head tags */
-    head_tags?: Management.AculHeadTag[] | undefined;
+    head_tags?: (Management.AculHeadTag[] | null) | undefined;
     filters?: (Management.AculFilters | null) | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -12531,7 +12544,7 @@ export interface GetClientResponseContent {
     /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
     grant_types?: string[] | undefined;
     jwt_configuration?: Management.ClientJwtConfiguration | undefined;
-    signing_keys?: Management.ClientSigningKeys | undefined;
+    signing_keys?: ((Management.ClientSigningKeys | undefined) | null) | undefined;
     encryption_key?: (Management.ClientEncryptionKey | null) | undefined;
     /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
     sso?: boolean | undefined;
@@ -12584,6 +12597,12 @@ export interface GetClientResponseContent {
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -12667,6 +12686,34 @@ export interface GetCustomSigningKeysResponseContent {
  * An object containing custom dictionaries for a group of screens.
  */
 export type GetCustomTextsByLanguageResponseContent = Record<string, unknown>;
+export interface GetDefaultCanonicalDomainResponseContent {
+    /** Domain name. */
+    domain: string;
+}
+export interface GetDefaultCustomDomainResponseContent {
+    /** ID of the custom domain. */
+    custom_domain_id: string;
+    /** Domain name. */
+    domain: string;
+    /** Whether this is a primary domain (true) or not (false). */
+    primary: boolean;
+    /** Whether this is the default custom domain (true) or not (false). */
+    is_default?: boolean | undefined;
+    status: Management.CustomDomainStatusFilterEnum;
+    type: Management.CustomDomainTypeEnum;
+    /** Intermediate address. */
+    origin_domain_name?: string | undefined;
+    verification?: Management.DomainVerification | undefined;
+    /** The HTTP header to fetch the client's IP address */
+    custom_client_ip_header?: (string | null) | undefined;
+    /** The TLS version policy */
+    tls_policy?: string | undefined;
+    domain_metadata?: Management.DomainMetadata | undefined;
+    certificate?: Management.DomainCertificate | undefined;
+    /** Relying Party ID (rpId) to be used for Passkeys on this custom domain. If not present, the full domain will be used. */
+    relying_party_identifier?: string | undefined;
+}
+export type GetDefaultDomainResponseContent = Management.GetDefaultCustomDomainResponseContent | Management.GetDefaultCanonicalDomainResponseContent;
 export interface GetDirectoryProvisioningDefaultMappingResponseContent {
     /** The mapping between Auth0 and IDP user attributes */
     mapping?: Management.DirectoryProvisioningMappingItem[] | undefined;
@@ -12682,6 +12729,7 @@ export interface GetDirectoryProvisioningResponseContent {
     mapping: Management.DirectoryProvisioningMappingItem[];
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically: boolean;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
     /** The timestamp at which the directory provisioning configuration was created */
     created_at: string;
     /** The timestamp at which the directory provisioning configuration was last updated */
@@ -12837,17 +12885,14 @@ export interface GetGroupMembersResponseContent {
 export interface GetGroupResponseContent {
     /** Unique identifier for the group (service-generated). */
     id: string;
-    /** Name of the group. Must be unique within its scope (connection, organization, or tenant). Must contain between 1 and 128 printable ASCII characters. */
+    /** Name of the group. Must be unique within its connection. Must contain between 1 and 128 printable ASCII characters. */
     name: string;
     /** External identifier for the group, often used for SCIM synchronization. Max length of 256 characters. */
     external_id?: string | undefined;
     /** Identifier for the connection this group belongs to (if a connection group). */
     connection_id?: string | undefined;
-    /** Identifier for the organization this group belongs to (if an organization group). */
-    organization_id?: (string | null) | undefined;
     /** Identifier for the tenant this group belongs to. */
     tenant_name: string;
-    description?: (string | null) | undefined;
     /** Timestamp of when the group was created. */
     created_at: string;
     /** Timestamp of when the group was last updated. */
@@ -13077,6 +13122,22 @@ export interface GetNetworkAclsResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface GetOrganizationAllConnectionResponseContent {
+    /** Name of the connection in the scope of this organization. */
+    organization_connection_name?: string | undefined;
+    /** When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection. */
+    assign_membership_on_login?: boolean | undefined;
+    /** Determines whether a connection should be displayed on this organization’s login prompt. Only applicable for enterprise connections. Default: true. */
+    show_as_button?: boolean | undefined;
+    /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
+    is_signup_enabled?: boolean | undefined;
+    organization_access_level?: Management.OrganizationAccessLevelEnum | undefined;
+    /** Whether the connection is enabled for the organization. */
+    is_enabled?: boolean | undefined;
+    /** Connection identifier. */
+    connection_id: string;
+    connection?: Management.OrganizationConnectionInformation | undefined;
+}
 export interface GetOrganizationByNameResponseContent {
     /** Organization identifier. */
     id?: string | undefined;
@@ -13199,6 +13260,13 @@ export interface GetRefreshTokenResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface GetRefreshTokensPaginatedResponseContent {
+    refresh_tokens?: Management.RefreshTokenResponseContent[] | undefined;
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export interface GetResourceServerResponseContent {
     /** ID of the API (resource server). */
     id?: string | undefined;
@@ -13215,6 +13283,8 @@ export interface GetResourceServerResponseContent {
     signing_secret?: string | undefined;
     /** Whether refresh tokens can be issued for this API (true) or not (false). */
     allow_offline_access?: boolean | undefined;
+    /** Whether Online Refresh Tokens can be issued for this API (true) or not (false). */
+    allow_online_access?: boolean | undefined;
     /** Whether to skip user consent for applications flagged as first party (true) or not (false). */
     skip_consent_for_verifiable_first_party_clients?: boolean | undefined;
     /** Expiration value (in seconds) for access tokens issued for this API from the token endpoint. */
@@ -13226,7 +13296,7 @@ export interface GetResourceServerResponseContent {
     token_dialect?: Management.ResourceServerTokenDialectResponseEnum | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
-    authorization_details?: unknown[] | undefined;
+    authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
     /** The client ID of the client that this resource server is linked to */
@@ -13423,7 +13493,7 @@ export interface GetTenantSettingsResponseContent {
     /** Whether to enable flexible factors for MFA in the PostLogin action */
     customize_mfa_in_postlogin_action?: boolean | undefined;
     /** Supported ACR values */
-    acr_values_supported?: string[] | undefined;
+    acr_values_supported?: (string[] | null) | undefined;
     mtls?: (Management.TenantSettingsMtls | null) | undefined;
     /** Enables the use of Pushed Authorization Requests */
     pushed_authorization_requests_supported?: boolean | undefined;
@@ -13594,17 +13664,14 @@ export interface GetVerifiableCredentialTemplateResponseContent {
 export interface Group {
     /** Unique identifier for the group (service-generated). */
     id?: string | undefined;
-    /** Name of the group. Must be unique within its scope (connection, organization, or tenant). Must contain between 1 and 128 printable ASCII characters. */
+    /** Name of the group. Must be unique within its connection. Must contain between 1 and 128 printable ASCII characters. */
     name?: string | undefined;
     /** External identifier for the group, often used for SCIM synchronization. Max length of 256 characters. */
     external_id?: string | undefined;
     /** Identifier for the connection this group belongs to (if a connection group). */
     connection_id?: string | undefined;
-    /** Identifier for the organization this group belongs to (if an organization group). */
-    organization_id?: (string | null) | undefined;
     /** Identifier for the tenant this group belongs to. */
     tenant_name?: string | undefined;
-    description?: (string | null) | undefined;
     /** Timestamp of when the group was created. */
     created_at?: string | undefined;
     /** Timestamp of when the group was last updated. */
@@ -13748,7 +13815,6 @@ export declare const IdentityProviderEnum: {
     readonly Apple: "apple";
     readonly Dropbox: "dropbox";
     readonly Bitbucket: "bitbucket";
-    readonly Aol: "aol";
     readonly Auth0Oidc: "auth0-oidc";
     readonly Auth0: "auth0";
     readonly Baidu: "baidu";
@@ -13763,7 +13829,6 @@ export declare const IdentityProviderEnum: {
     readonly Exact: "exact";
     readonly Facebook: "facebook";
     readonly Fitbit: "fitbit";
-    readonly Flickr: "flickr";
     readonly Github: "github";
     readonly GoogleApps: "google-apps";
     readonly GoogleOauth2: "google-oauth2";
@@ -13771,7 +13836,6 @@ export declare const IdentityProviderEnum: {
     readonly Ip: "ip";
     readonly Line: "line";
     readonly Linkedin: "linkedin";
-    readonly Miicard: "miicard";
     readonly Oauth1: "oauth1";
     readonly Oauth2: "oauth2";
     readonly Office365: "office365";
@@ -13781,7 +13845,6 @@ export declare const IdentityProviderEnum: {
     readonly PaypalSandbox: "paypal-sandbox";
     readonly Pingfederate: "pingfederate";
     readonly Planningcenter: "planningcenter";
-    readonly Renren: "renren";
     readonly SalesforceCommunity: "salesforce-community";
     readonly SalesforceSandbox: "salesforce-sandbox";
     readonly Salesforce: "salesforce";
@@ -13791,8 +13854,6 @@ export declare const IdentityProviderEnum: {
     readonly Shop: "shop";
     readonly Sms: "sms";
     readonly Soundcloud: "soundcloud";
-    readonly ThecitySandbox: "thecity-sandbox";
-    readonly Thecity: "thecity";
     readonly Thirtysevensignals: "thirtysevensignals";
     readonly Twitter: "twitter";
     readonly Untappd: "untappd";
@@ -13802,7 +13863,6 @@ export declare const IdentityProviderEnum: {
     readonly Windowslive: "windowslive";
     readonly Wordpress: "wordpress";
     readonly Yahoo: "yahoo";
-    readonly Yammer: "yammer";
     readonly Yandex: "yandex";
 };
 export type IdentityProviderEnum = (typeof IdentityProviderEnum)[keyof typeof IdentityProviderEnum];
@@ -14006,13 +14066,13 @@ export interface ListAculsResponseContentItem {
     screen?: string | undefined;
     /** Rendering mode */
     rendering_mode?: Management.AculRenderingModeEnum | undefined;
-    context_configuration?: Management.AculContextConfiguration | undefined;
+    context_configuration?: ((Management.AculContextConfiguration | undefined) | null) | undefined;
     /** Override Universal Login default head tags */
     default_head_tags_disabled?: (boolean | null) | undefined;
     /** Use page template with ACUL */
     use_page_template?: (boolean | null) | undefined;
     /** An array of head tags */
-    head_tags?: Management.AculHeadTag[] | undefined;
+    head_tags?: (Management.AculHeadTag[] | null) | undefined;
     filters?: (Management.AculFilters | null) | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -14141,6 +14201,12 @@ export interface ListNetworkAclsOffsetPaginatedResponseContent {
     limit?: number | undefined;
     total?: number | undefined;
 }
+export interface ListOrganizationAllConnectionsOffsetPaginatedResponseContent {
+    start?: number | undefined;
+    limit?: number | undefined;
+    total?: number | undefined;
+    connections?: Management.OrganizationAllConnectionPost[] | undefined;
+}
 export interface ListOrganizationClientGrantsOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -14887,6 +14953,8 @@ export interface NativeSocialLoginGoogle {
     /** Determine whether or not to allow signing in natively using a Google ID token */
     enabled?: boolean | undefined;
 }
+export type NetworkAclMatchConnectingIpv4Cidr = string;
+export type NetworkAclMatchConnectingIpv6Cidr = string;
 export type NetworkAclMatchIpv4Cidr = string;
 export type NetworkAclMatchIpv6Cidr = string;
 export interface NetworkAclAction {
@@ -14923,6 +14991,9 @@ export interface NetworkAclMatch {
     ja3_fingerprints?: string[] | undefined;
     ja4_fingerprints?: string[] | undefined;
     user_agents?: string[] | undefined;
+    hostnames?: string[] | undefined;
+    connecting_ipv4_cidrs?: Management.NetworkAclMatchConnectingIpv4Cidr[] | undefined;
+    connecting_ipv6_cidrs?: Management.NetworkAclMatchConnectingIpv6Cidr[] | undefined;
 }
 export interface NetworkAclRule {
     action: Management.NetworkAclAction;
@@ -14964,6 +15035,38 @@ export interface Organization {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** Access level for the organization (e.g., "none", "full"). */
+export declare const OrganizationAccessLevelEnum: {
+    readonly None: "none";
+    readonly Readonly: "readonly";
+    readonly Limited: "limited";
+    readonly Full: "full";
+};
+export type OrganizationAccessLevelEnum = (typeof OrganizationAccessLevelEnum)[keyof typeof OrganizationAccessLevelEnum];
+/** Access level for the organization (e.g., "none", "full"). */
+export declare const OrganizationAccessLevelEnumWithNull: {
+    readonly None: "none";
+    readonly Readonly: "readonly";
+    readonly Limited: "limited";
+    readonly Full: "full";
+};
+export type OrganizationAccessLevelEnumWithNull = (typeof OrganizationAccessLevelEnumWithNull)[keyof typeof OrganizationAccessLevelEnumWithNull];
+export interface OrganizationAllConnectionPost {
+    /** Name of the connection in the scope of this organization. */
+    organization_connection_name?: string | undefined;
+    /** When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection. */
+    assign_membership_on_login?: boolean | undefined;
+    /** Determines whether a connection should be displayed on this organization’s login prompt. Only applicable for enterprise connections. Default: true. */
+    show_as_button?: boolean | undefined;
+    /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
+    is_signup_enabled?: boolean | undefined;
+    organization_access_level?: Management.OrganizationAccessLevelEnum | undefined;
+    /** Whether the connection is enabled for the organization. */
+    is_enabled?: boolean | undefined;
+    /** Connection identifier. */
+    connection_id: string;
+    connection?: Management.OrganizationConnectionInformation | undefined;
+}
 /**
  * Theme defines how to style the login pages.
  */
@@ -15097,7 +15200,7 @@ export interface OrganizationMemberRole {
 /**
  * Metadata associated with the organization, in the form of an object with string values (max 255 chars). Maximum of 25 metadata properties allowed.
  */
-export type OrganizationMetadata = Record<string, (string | null) | undefined>;
+export type OrganizationMetadata = Record<string, string | null>;
 /** Defines whether organizations can be used with client credentials exchanges for this grant. */
 export declare const OrganizationUsageEnum: {
     readonly Deny: "deny";
@@ -15123,6 +15226,43 @@ export interface PartialPhoneTemplateContent {
     from?: string | undefined;
     body?: Management.PhoneTemplateBody | undefined;
 }
+export declare const PasswordCharacterTypeEnum: {
+    readonly Uppercase: "uppercase";
+    readonly Lowercase: "lowercase";
+    readonly Number: "number";
+    readonly Special: "special";
+};
+export type PasswordCharacterTypeEnum = (typeof PasswordCharacterTypeEnum)[keyof typeof PasswordCharacterTypeEnum];
+/** When enabled, passwords must contain at least 3 out of 4 character types. Can only be enabled when all 4 character types are specified */
+export declare const PasswordCharacterTypeRulePolicyEnum: {
+    readonly All: "all";
+    readonly ThreeOfFour: "three_of_four";
+};
+export type PasswordCharacterTypeRulePolicyEnum = (typeof PasswordCharacterTypeRulePolicyEnum)[keyof typeof PasswordCharacterTypeRulePolicyEnum];
+/** Default dictionary to use for password validation. Options: "en_10k" (10,000 common words) or "en_100k" (100,000 common words) */
+export declare const PasswordDefaultDictionariesEnum: {
+    readonly En10K: "en_10k";
+    readonly En100K: "en_100k";
+};
+export type PasswordDefaultDictionariesEnum = (typeof PasswordDefaultDictionariesEnum)[keyof typeof PasswordDefaultDictionariesEnum];
+/** Controls whether identical consecutive characters are allowed in passwords */
+export declare const PasswordIdenticalCharactersPolicyEnum: {
+    readonly Allow: "allow";
+    readonly Block: "block";
+};
+export type PasswordIdenticalCharactersPolicyEnum = (typeof PasswordIdenticalCharactersPolicyEnum)[keyof typeof PasswordIdenticalCharactersPolicyEnum];
+/** Controls whether passwords that exceed the maximum length are truncated or rejected */
+export declare const PasswordMaxLengthExceededPolicyEnum: {
+    readonly Truncate: "truncate";
+    readonly Error: "error";
+};
+export type PasswordMaxLengthExceededPolicyEnum = (typeof PasswordMaxLengthExceededPolicyEnum)[keyof typeof PasswordMaxLengthExceededPolicyEnum];
+/** Controls whether sequential characters are allowed in passwords */
+export declare const PasswordSequentialCharactersPolicyEnum: {
+    readonly Allow: "allow";
+    readonly Block: "block";
+};
+export type PasswordSequentialCharactersPolicyEnum = (typeof PasswordSequentialCharactersPolicyEnum)[keyof typeof PasswordSequentialCharactersPolicyEnum];
 export interface PatchClientCredentialResponseContent {
     /** ID of the credential. Generated on creation. */
     id?: string | undefined;
@@ -15312,6 +15452,16 @@ export declare const PreferredAuthenticationMethodEnum: {
     readonly Sms: "sms";
 };
 export type PreferredAuthenticationMethodEnum = (typeof PreferredAuthenticationMethodEnum)[keyof typeof PreferredAuthenticationMethodEnum];
+export interface PreviewCimdMetadataResponseContent {
+    /** The client_id of an existing client registered with this external_client_id, if one exists. */
+    client_id?: string | undefined;
+    /** Array of retrieval errors (populated when the metadata document could not be fetched). When present, validation is omitted. */
+    errors?: string[] | undefined;
+    validation?: Management.CimdValidationResult | undefined;
+    mapped_fields?: Management.CimdMappedClientFields | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 /** Name of the prompt */
 export declare const PromptGroupNameEnum: {
     readonly Login: "login";
@@ -15434,6 +15584,7 @@ export declare const PromptLanguageEnum: {
     readonly Zgh: "zgh";
     readonly ZhCn: "zh-CN";
     readonly ZhHk: "zh-HK";
+    readonly ZhMo: "zh-MO";
     readonly ZhTw: "zh-TW";
 };
 export type PromptLanguageEnum = (typeof PromptLanguageEnum)[keyof typeof PromptLanguageEnum];
@@ -15448,6 +15599,8 @@ export interface PublicKeyCredential {
     parse_expiry_from_cert?: boolean | undefined;
     /** The ISO 8601 formatted date representing the expiration of the credential. If not specified (not recommended), the credential never expires. Applies to `public_key` credential type. */
     expires_at?: string | undefined;
+    /** Optional kid (Key ID), used to uniquely identify the credential. If not specified, a kid value will be auto-generated. The kid header parameter in JWTs sent by your client should match this value. Valid format is [0-9a-zA-Z-_]{10,64} */
+    kid?: string | undefined;
 }
 /** Algorithm which will be used with the credential. Can be one of RS256, RS384, PS256. If not specified, RS256 will be used. Applies to `public_key` credential type. */
 export declare const PublicKeyCredentialAlgorithmEnum: {
@@ -15543,6 +15696,17 @@ export interface RegenerateUsersRecoveryCodeResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Response after successfully registering or updating a CIMD client
+ */
+export interface RegisterCimdClientResponseContent {
+    /** The Auth0 client_id of the created or updated client */
+    client_id: string;
+    mapped_fields: Management.CimdMappedClientFields;
+    validation: Management.CimdValidationResult;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export type ResetPhoneTemplateRequestContent = unknown;
 export interface ResetPhoneTemplateResponseContent {
     id: string;
@@ -15570,6 +15734,8 @@ export interface ResourceServer {
     signing_secret?: string | undefined;
     /** Whether refresh tokens can be issued for this API (true) or not (false). */
     allow_offline_access?: boolean | undefined;
+    /** Whether Online Refresh Tokens can be issued for this API (true) or not (false). */
+    allow_online_access?: boolean | undefined;
     /** Whether to skip user consent for applications flagged as first party (true) or not (false). */
     skip_consent_for_verifiable_first_party_clients?: boolean | undefined;
     /** Expiration value (in seconds) for access tokens issued for this API from the token endpoint. */
@@ -15581,7 +15747,7 @@ export interface ResourceServer {
     token_dialect?: Management.ResourceServerTokenDialectResponseEnum | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
-    authorization_details?: unknown[] | undefined;
+    authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
     /** The client ID of the client that this resource server is linked to */
@@ -15785,7 +15951,7 @@ export interface RotateClientSecretResponseContent {
     /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
     grant_types?: string[] | undefined;
     jwt_configuration?: Management.ClientJwtConfiguration | undefined;
-    signing_keys?: Management.ClientSigningKeys | undefined;
+    signing_keys?: ((Management.ClientSigningKeys | undefined) | null) | undefined;
     encryption_key?: (Management.ClientEncryptionKey | null) | undefined;
     /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
     sso?: boolean | undefined;
@@ -15838,6 +16004,12 @@ export interface RotateClientSecretResponseContent {
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -16123,7 +16295,7 @@ export interface SelfServiceProfileSsoTicketConnectionOptions {
     /** URL for the icon. Must use HTTPS. */
     icon_url?: (string | null) | undefined;
     /** List of domain_aliases that can be authenticated in the Identity Provider */
-    domain_aliases?: string[] | undefined;
+    domain_aliases?: (string[] | null) | undefined;
     idpinitiated?: (Management.SelfServiceProfileSsoTicketIdpInitiatedOptions | null) | undefined;
 }
 /**
@@ -16625,6 +16797,7 @@ export declare const SupportedLocales: {
     readonly Zgh: "zgh";
     readonly ZhCn: "zh-CN";
     readonly ZhHk: "zh-HK";
+    readonly ZhMo: "zh-MO";
     readonly ZhTw: "zh-TW";
 };
 export type SupportedLocales = (typeof SupportedLocales)[keyof typeof SupportedLocales];
@@ -16663,6 +16836,12 @@ export interface SuspiciousIpThrottlingStage {
     "pre-login"?: Management.SuspiciousIpThrottlingPreLoginStage | undefined;
     "pre-user-registration"?: Management.SuspiciousIpThrottlingPreUserRegistrationStage | undefined;
 }
+/** Group synchronization configuration */
+export declare const SynchronizeGroupsEnum: {
+    readonly All: "all";
+    readonly Off: "off";
+};
+export type SynchronizeGroupsEnum = (typeof SynchronizeGroupsEnum)[keyof typeof SynchronizeGroupsEnum];
 /**
  * Settings related to OIDC RP-initiated Logout
  */
@@ -16877,6 +17056,7 @@ export declare const TenantSettingsSupportedLocalesEnum: {
     readonly Zgh: "zgh";
     readonly ZhCn: "zh-CN";
     readonly ZhHk: "zh-HK";
+    readonly ZhMo: "zh-MO";
     readonly ZhTw: "zh-TW";
 };
 export type TenantSettingsSupportedLocalesEnum = (typeof TenantSettingsSupportedLocalesEnum)[keyof typeof TenantSettingsSupportedLocalesEnum];
@@ -17024,13 +17204,13 @@ export interface UpdateActionResponseContent {
 export interface UpdateAculResponseContent {
     /** Rendering mode */
     rendering_mode?: Management.AculRenderingModeEnum | undefined;
-    context_configuration?: Management.AculContextConfiguration | undefined;
+    context_configuration?: ((Management.AculContextConfiguration | undefined) | null) | undefined;
     /** Override Universal Login default head tags */
     default_head_tags_disabled?: (boolean | null) | undefined;
     /** Use page template with ACUL */
     use_page_template?: (boolean | null) | undefined;
     /** An array of head tags */
-    head_tags?: Management.AculHeadTag[] | undefined;
+    head_tags?: (Management.AculHeadTag[] | null) | undefined;
     filters?: (Management.AculFilters | null) | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -17209,7 +17389,7 @@ export interface UpdateClientResponseContent {
     /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
     grant_types?: string[] | undefined;
     jwt_configuration?: Management.ClientJwtConfiguration | undefined;
-    signing_keys?: Management.ClientSigningKeys | undefined;
+    signing_keys?: ((Management.ClientSigningKeys | undefined) | null) | undefined;
     encryption_key?: (Management.ClientEncryptionKey | null) | undefined;
     /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
     sso?: boolean | undefined;
@@ -17262,6 +17442,12 @@ export interface UpdateClientResponseContent {
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -17271,7 +17457,7 @@ export interface UpdateClientResponseContent {
 export interface UpdateConnectionOptions {
     validation?: (Management.ConnectionValidationOptions | null) | undefined;
     /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */
-    non_persistent_attrs?: string[] | undefined;
+    non_persistent_attrs?: (string[] | null) | undefined;
     /** Order of precedence for attribute types. If the property is not specified, the default precedence of attributes will be used. */
     precedence?: Management.ConnectionIdentifierPrecedenceEnum[] | undefined;
     attributes?: Management.ConnectionAttributes | undefined;
@@ -17281,6 +17467,8 @@ export interface UpdateConnectionOptions {
     enabledDatabaseCustomization?: boolean | undefined;
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
+    /** Stores encrypted string only configurations for connections */
+    configuration?: (Record<string, string | null> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
@@ -17302,6 +17490,7 @@ export interface UpdateConnectionOptions {
     set_user_root_attributes?: Management.ConnectionSetUserRootAttributesEnum | undefined;
     gateway_authentication?: (Management.ConnectionGatewayAuthentication | null) | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
+    password_options?: Management.ConnectionPasswordOptions | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -17327,12 +17516,6 @@ export interface UpdateConnectionRequestContentAdfs extends Management.Connectio
     options?: Management.ConnectionOptionsAdfs | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
-/**
- * Update a connection with strategy=aol
- */
-export interface UpdateConnectionRequestContentAol extends Management.ConnectionCommon {
-    options?: Management.ConnectionOptionsAol | undefined;
-}
 /**
  * Update a connection with strategy=amazon
  */
@@ -17449,12 +17632,6 @@ export interface UpdateConnectionRequestContentFacebook extends Management.Conne
 export interface UpdateConnectionRequestContentFitbit extends Management.ConnectionCommon {
     options?: Management.ConnectionOptionsFitbit | undefined;
 }
-/**
- * Update a connection with strategy=flickr
- */
-export interface UpdateConnectionRequestContentFlickr extends Management.ConnectionCommon {
-    options?: Management.ConnectionOptionsFlickr | undefined;
-}
 /**
  * Update a connection with strategy=github
  */
@@ -17499,12 +17676,6 @@ export interface UpdateConnectionRequestContentLine extends Management.Connectio
 export interface UpdateConnectionRequestContentLinkedin extends Management.ConnectionCommon {
     options?: Management.ConnectionOptionsLinkedin | undefined;
 }
-/**
- * Update a connection with strategy=miicard
- */
-export interface UpdateConnectionRequestContentMiicard extends Management.ConnectionCommon {
-    options?: Management.ConnectionOptionsMiicard | undefined;
-}
 /**
  * Update a connection with strategy=oauth1
  */
@@ -17565,12 +17736,6 @@ export interface UpdateConnectionRequestContentPingFederate extends Management.C
 export interface UpdateConnectionRequestContentPlanningCenter extends Management.ConnectionCommon {
     options?: Management.ConnectionOptionsPlanningCenter | undefined;
 }
-/**
- * Update a connection with strategy=renren
- */
-export interface UpdateConnectionRequestContentRenren extends Management.ConnectionCommon {
-    options?: Management.ConnectionOptionsRenren | undefined;
-}
 /**
  * Update a connection with strategy=samlp
  */
@@ -17675,12 +17840,6 @@ export interface UpdateConnectionRequestContentWordpress extends Management.Conn
 export interface UpdateConnectionRequestContentYahoo extends Management.ConnectionCommon {
     options?: Management.ConnectionOptionsYahoo | undefined;
 }
-/**
- * Update a connection with strategy=yammer
- */
-export interface UpdateConnectionRequestContentYammer extends Management.ConnectionCommon {
-    options?: Management.ConnectionOptionsYammer | undefined;
-}
 /**
  * Update a connection with strategy=yandex
  */
@@ -17730,11 +17889,40 @@ export interface UpdateCustomDomainResponseContent {
     /** Relying Party ID (rpId) to be used for Passkeys on this custom domain. If not present, the full domain will be used. */
     relying_party_identifier?: string | undefined;
 }
+export interface UpdateDefaultCanonicalDomainResponseContent {
+    /** Domain name. */
+    domain: string;
+}
+export interface UpdateDefaultCustomDomainResponseContent {
+    /** ID of the custom domain. */
+    custom_domain_id: string;
+    /** Domain name. */
+    domain: string;
+    /** Whether this is a primary domain (true) or not (false). */
+    primary: boolean;
+    /** Whether this is the default custom domain (true) or not (false). */
+    is_default?: boolean | undefined;
+    status: Management.CustomDomainStatusFilterEnum;
+    type: Management.CustomDomainTypeEnum;
+    /** Intermediate address. */
+    origin_domain_name?: string | undefined;
+    verification?: Management.DomainVerification | undefined;
+    /** The HTTP header to fetch the client's IP address */
+    custom_client_ip_header?: (string | null) | undefined;
+    /** The TLS version policy */
+    tls_policy?: string | undefined;
+    domain_metadata?: Management.DomainMetadata | undefined;
+    certificate?: Management.DomainCertificate | undefined;
+    /** Relying Party ID (rpId) to be used for Passkeys on this custom domain. If not present, the full domain will be used. */
+    relying_party_identifier?: string | undefined;
+}
+export type UpdateDefaultDomainResponseContent = Management.UpdateDefaultCustomDomainResponseContent | Management.UpdateDefaultCanonicalDomainResponseContent;
 export interface UpdateDirectoryProvisioningRequestContent {
     /** The mapping between Auth0 and IDP user attributes */
     mapping?: Management.DirectoryProvisioningMappingItem[] | undefined;
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically?: boolean | undefined;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
 }
 export interface UpdateDirectoryProvisioningResponseContent {
     /** The connection's identifier */
@@ -17747,6 +17935,7 @@ export interface UpdateDirectoryProvisioningResponseContent {
     mapping: Management.DirectoryProvisioningMappingItem[];
     /** Whether periodic automatic synchronization is enabled */
     synchronize_automatically: boolean;
+    synchronize_groups?: Management.SynchronizeGroupsEnum | undefined;
     /** The timestamp at which the directory provisioning configuration was created */
     created_at: string;
     /** The timestamp at which the directory provisioning configuration was last updated */
@@ -17892,6 +18081,22 @@ export interface UpdateNetworkAclResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface UpdateOrganizationAllConnectionResponseContent {
+    /** Name of the connection in the scope of this organization. */
+    organization_connection_name?: string | undefined;
+    /** When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection. */
+    assign_membership_on_login?: boolean | undefined;
+    /** Determines whether a connection should be displayed on this organization’s login prompt. Only applicable for enterprise connections. Default: true. */
+    show_as_button?: boolean | undefined;
+    /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
+    is_signup_enabled?: boolean | undefined;
+    organization_access_level?: Management.OrganizationAccessLevelEnum | undefined;
+    /** Whether the connection is enabled for the organization. */
+    is_enabled?: boolean | undefined;
+    /** Connection identifier. */
+    connection_id: string;
+    connection?: Management.OrganizationConnectionInformation | undefined;
+}
 export interface UpdateOrganizationConnectionResponseContent {
     /** ID of the connection. */
     connection_id?: string | undefined;
@@ -17976,6 +18181,8 @@ export interface UpdateResourceServerResponseContent {
     signing_secret?: string | undefined;
     /** Whether refresh tokens can be issued for this API (true) or not (false). */
     allow_offline_access?: boolean | undefined;
+    /** Whether Online Refresh Tokens can be issued for this API (true) or not (false). */
+    allow_online_access?: boolean | undefined;
     /** Whether to skip user consent for applications flagged as first party (true) or not (false). */
     skip_consent_for_verifiable_first_party_clients?: boolean | undefined;
     /** Expiration value (in seconds) for access tokens issued for this API from the token endpoint. */
@@ -17987,7 +18194,7 @@ export interface UpdateResourceServerResponseContent {
     token_dialect?: Management.ResourceServerTokenDialectResponseEnum | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
-    authorization_details?: unknown[] | undefined;
+    authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
     /** The client ID of the client that this resource server is linked to */
@@ -18147,7 +18354,7 @@ export interface UpdateTenantSettingsResponseContent {
     /** Whether to enable flexible factors for MFA in the PostLogin action */
     customize_mfa_in_postlogin_action?: boolean | undefined;
     /** Supported ACR values */
-    acr_values_supported?: string[] | undefined;
+    acr_values_supported?: (string[] | null) | undefined;
     mtls?: (Management.TenantSettingsMtls | null) | undefined;
     /** Enables the use of Pushed Authorization Requests */
     pushed_authorization_requests_supported?: boolean | undefined;
@@ -18528,7 +18735,6 @@ export declare const UserIdentityProviderEnum: {
     readonly Apple: "apple";
     readonly Dropbox: "dropbox";
     readonly Bitbucket: "bitbucket";
-    readonly Aol: "aol";
     readonly Auth0Oidc: "auth0-oidc";
     readonly Auth0: "auth0";
     readonly Baidu: "baidu";
@@ -18543,7 +18749,6 @@ export declare const UserIdentityProviderEnum: {
     readonly Exact: "exact";
     readonly Facebook: "facebook";
     readonly Fitbit: "fitbit";
-    readonly Flickr: "flickr";
     readonly Github: "github";
     readonly GoogleApps: "google-apps";
     readonly GoogleOauth2: "google-oauth2";
@@ -18551,7 +18756,6 @@ export declare const UserIdentityProviderEnum: {
     readonly Ip: "ip";
     readonly Line: "line";
     readonly Linkedin: "linkedin";
-    readonly Miicard: "miicard";
     readonly Oauth1: "oauth1";
     readonly Oauth2: "oauth2";
     readonly Office365: "office365";
@@ -18561,7 +18765,6 @@ export declare const UserIdentityProviderEnum: {
     readonly PaypalSandbox: "paypal-sandbox";
     readonly Pingfederate: "pingfederate";
     readonly Planningcenter: "planningcenter";
-    readonly Renren: "renren";
     readonly SalesforceCommunity: "salesforce-community";
     readonly SalesforceSandbox: "salesforce-sandbox";
     readonly Salesforce: "salesforce";
@@ -18571,8 +18774,6 @@ export declare const UserIdentityProviderEnum: {
     readonly Shop: "shop";
     readonly Sms: "sms";
     readonly Soundcloud: "soundcloud";
-    readonly ThecitySandbox: "thecity-sandbox";
-    readonly Thecity: "thecity";
     readonly Thirtysevensignals: "thirtysevensignals";
     readonly Twitter: "twitter";
     readonly Untappd: "untappd";
@@ -18582,7 +18783,6 @@ export declare const UserIdentityProviderEnum: {
     readonly Windowslive: "windowslive";
     readonly Wordpress: "wordpress";
     readonly Yahoo: "yahoo";
-    readonly Yammer: "yammer";
     readonly Yandex: "yandex";
 };
 export type UserIdentityProviderEnum = (typeof UserIdentityProviderEnum)[keyof typeof UserIdentityProviderEnum];