auth0 5.6.0 → 5.7.0

package/dist/esm/management/api/resources/connections/resources/directoryProvisioning/client/Client.mjs

@@ -424,4 +424,156 @@ export class DirectoryProvisioningClient {
             return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/connections/{id}/directory-provisioning/default-mapping");
         });
     }
+    /**
+     * Retrieve the configured synchronized groups for a connection directory provisioning configuration.
+     *
+     * @param {string} id - The id of the connection to list synchronized groups for.
+     * @param {Management.ListSynchronizedGroupsRequestParameters} request
+     * @param {DirectoryProvisioningClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.connections.directoryProvisioning.listSynchronizedGroups("id", {
+     *         from: "from",
+     *         take: 1
+     *     })
+     */
+    listSynchronizedGroups(id_1) {
+        return __awaiter(this, arguments, void 0, function* (id, request = {}, requestOptions) {
+            const list = core.HttpResponsePromise.interceptFunction((request) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+                const { from: from_, take = 50 } = request;
+                const _queryParams = {
+                    from: from_,
+                    take,
+                };
+                const _authRequest = yield this._options.authProvider.getAuthRequest();
+                let _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+                const _response = yield ((_b = this._options.fetcher) !== null && _b !== void 0 ? _b : core.fetcher)({
+                    url: core.url.join((_d = (_c = (yield core.Supplier.get(this._options.baseUrl))) !== null && _c !== void 0 ? _c : (yield core.Supplier.get(this._options.environment))) !== null && _d !== void 0 ? _d : environments.ManagementEnvironment.Default, `connections/${core.url.encodePathParam(id)}/directory-provisioning/synchronized-groups`),
+                    method: "GET",
+                    headers: _headers,
+                    queryParameters: Object.assign(Object.assign({}, _queryParams), requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams),
+                    timeoutMs: ((_g = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _e !== void 0 ? _e : (_f = this._options) === null || _f === void 0 ? void 0 : _f.timeoutInSeconds) !== null && _g !== void 0 ? _g : 60) * 1000,
+                    maxRetries: (_h = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _h !== void 0 ? _h : (_j = this._options) === null || _j === void 0 ? void 0 : _j.maxRetries,
+                    abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                    fetchFn: (_k = this._options) === null || _k === void 0 ? void 0 : _k.fetch,
+                    logging: this._options.logging,
+                });
+                if (_response.ok) {
+                    return {
+                        data: _response.body,
+                        rawResponse: _response.rawResponse,
+                    };
+                }
+                if (_response.error.reason === "status-code") {
+                    switch (_response.error.statusCode) {
+                        case 400:
+                            throw new Management.BadRequestError(_response.error.body, _response.rawResponse);
+                        case 401:
+                            throw new Management.UnauthorizedError(_response.error.body, _response.rawResponse);
+                        case 403:
+                            throw new Management.ForbiddenError(_response.error.body, _response.rawResponse);
+                        case 404:
+                            throw new Management.NotFoundError(_response.error.body, _response.rawResponse);
+                        case 429:
+                            throw new Management.TooManyRequestsError(_response.error.body, _response.rawResponse);
+                        default:
+                            throw new errors.ManagementError({
+                                statusCode: _response.error.statusCode,
+                                body: _response.error.body,
+                                rawResponse: _response.rawResponse,
+                            });
+                    }
+                }
+                return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/connections/{id}/directory-provisioning/synchronized-groups");
+            }));
+            const dataWithRawResponse = yield list(request).withRawResponse();
+            return new core.Page({
+                response: dataWithRawResponse.data,
+                rawResponse: dataWithRawResponse.rawResponse,
+                hasNextPage: (response) => (response === null || response === void 0 ? void 0 : response.next) != null && !(typeof (response === null || response === void 0 ? void 0 : response.next) === "string" && (response === null || response === void 0 ? void 0 : response.next) === ""),
+                getItems: (response) => { var _a; return (_a = response === null || response === void 0 ? void 0 : response.groups) !== null && _a !== void 0 ? _a : []; },
+                loadPage: (response) => {
+                    return list(core.setObjectProperty(request, "from", response === null || response === void 0 ? void 0 : response.next));
+                },
+            });
+        });
+    }
+    /**
+     * Create or replace the selected groups for a connection directory provisioning configuration.
+     *
+     * @param {string} id - The id of the connection to create or replace synchronized groups for
+     * @param {Management.ReplaceSynchronizedGroupsRequestContent} request
+     * @param {DirectoryProvisioningClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.ConflictError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.connections.directoryProvisioning.set("id", {
+     *         groups: [{
+     *                 id: "id"
+     *             }]
+     *     })
+     */
+    set(id, request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__set(id, request, requestOptions));
+    }
+    __set(id, request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            let _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield ((_b = this._options.fetcher) !== null && _b !== void 0 ? _b : core.fetcher)({
+                url: core.url.join((_d = (_c = (yield core.Supplier.get(this._options.baseUrl))) !== null && _c !== void 0 ? _c : (yield core.Supplier.get(this._options.environment))) !== null && _d !== void 0 ? _d : environments.ManagementEnvironment.Default, `connections/${core.url.encodePathParam(id)}/directory-provisioning/synchronized-groups`),
+                method: "PUT",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: request,
+                timeoutMs: ((_g = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _e !== void 0 ? _e : (_f = this._options) === null || _f === void 0 ? void 0 : _f.timeoutInSeconds) !== null && _g !== void 0 ? _g : 60) * 1000,
+                maxRetries: (_h = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _h !== void 0 ? _h : (_j = this._options) === null || _j === void 0 ? void 0 : _j.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_k = this._options) === null || _k === void 0 ? void 0 : _k.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return { data: undefined, rawResponse: _response.rawResponse };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new Management.BadRequestError(_response.error.body, _response.rawResponse);
+                    case 401:
+                        throw new Management.UnauthorizedError(_response.error.body, _response.rawResponse);
+                    case 403:
+                        throw new Management.ForbiddenError(_response.error.body, _response.rawResponse);
+                    case 404:
+                        throw new Management.NotFoundError(_response.error.body, _response.rawResponse);
+                    case 409:
+                        throw new Management.ConflictError(_response.error.body, _response.rawResponse);
+                    case 429:
+                        throw new Management.TooManyRequestsError(_response.error.body, _response.rawResponse);
+                    default:
+                        throw new errors.ManagementError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/connections/{id}/directory-provisioning/synchronized-groups");
+        });
+    }
 }

package/dist/esm/management/api/resources/eventStreams/client/Client.d.mts

@@ -112,7 +112,7 @@ export declare class EventStreamsClient {
      *
      * @example
      *     await client.eventStreams.test("id", {
-     *         event_type: "user.created"
+     *         event_type: "group.created"
      *     })
      */
     test(id: string, request: Management.CreateEventStreamTestEventRequestContent, requestOptions?: EventStreamsClient.RequestOptions): core.HttpResponsePromise<Management.CreateEventStreamTestEventResponseContent>;

package/dist/esm/management/api/resources/eventStreams/client/Client.mjs

@@ -365,7 +365,7 @@ export class EventStreamsClient {
      *
      * @example
      *     await client.eventStreams.test("id", {
-     *         event_type: "user.created"
+     *         event_type: "group.created"
      *     })
      */
     test(id, request, requestOptions) {

package/dist/esm/management/api/types/types.d.mts

@@ -1870,6 +1870,9 @@ export interface Client {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -2444,6 +2447,11 @@ export type ClientExternalMetadataTypeEnum = (typeof ClientExternalMetadataTypeE
  * Optional filter on allow_any_organization.
  */
 export type ClientGrantAllowAnyOrganizationEnum = boolean;
+/** Used to filter the returned client grants to include only default client grants for the specified group of clients. */
+export declare const ClientGrantDefaultForEnum: {
+    readonly ThirdPartyClients: "third_party_clients";
+};
+export type ClientGrantDefaultForEnum = (typeof ClientGrantDefaultForEnum)[keyof typeof ClientGrantDefaultForEnum];
 /** Controls how organizations may be used with this grant */
 export declare const ClientGrantOrganizationNullableUsageEnum: {
     readonly Deny: "deny";
@@ -2470,6 +2478,8 @@ export interface ClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    /** Applies this client grant as the default for all clients in the specified group. The only accepted value is `third_party_clients`, which applies the grant to all third-party clients. Per-client grants for the same audience take precedence. Mutually exclusive with `client_id`. */
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -2536,6 +2546,71 @@ export interface ClientMobileiOs {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** The allowed connection strategy values for the My Organization Configuration. */
+export declare const ClientMyOrganizationConfigurationAllowedStrategiesEnum: {
+    readonly Pingfederate: "pingfederate";
+    readonly Adfs: "adfs";
+    readonly Waad: "waad";
+    readonly GoogleApps: "google-apps";
+    readonly Okta: "okta";
+    readonly Oidc: "oidc";
+    readonly Samlp: "samlp";
+};
+export type ClientMyOrganizationConfigurationAllowedStrategiesEnum = (typeof ClientMyOrganizationConfigurationAllowedStrategiesEnum)[keyof typeof ClientMyOrganizationConfigurationAllowedStrategiesEnum];
+/** The deletion behavior for this client. */
+export declare const ClientMyOrganizationDeletionBehaviorEnum: {
+    readonly Allow: "allow";
+    readonly AllowIfEmpty: "allow_if_empty";
+};
+export type ClientMyOrganizationDeletionBehaviorEnum = (typeof ClientMyOrganizationDeletionBehaviorEnum)[keyof typeof ClientMyOrganizationDeletionBehaviorEnum];
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationPatchConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
+    /** List of role IDs allowed when inviting users through the My Organization API. */
+    allowed_roles?: string[] | undefined;
+}
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationPostConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
+    /** List of role IDs allowed when inviting users through the My Organization API. */
+    allowed_roles?: string[] | undefined;
+}
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationResponseConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+    /** The client ID this client uses while creating invitations through My Organization API. */
+    invitation_landing_client_id?: string | undefined;
+    /** List of role IDs allowed when inviting users through the My Organization API. */
+    allowed_roles?: string[] | undefined;
+}
 /**
  * Configuration for OIDC backchannel logout initiators
  */
@@ -2618,6 +2693,12 @@ export declare const ClientOrganizationUsagePatchEnum: {
     readonly Require: "require";
 };
 export type ClientOrganizationUsagePatchEnum = (typeof ClientOrganizationUsagePatchEnum)[keyof typeof ClientOrganizationUsagePatchEnum];
+/** Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows. `open_redirect_protection` shows an error page instead of redirecting, and hides the callback domain from email templates. `allow_always` enables standard redirect behavior. Defaults to `open_redirect_protection` for third-party clients. Only applies when `is_first_party` is `false` and `third_party_security_mode` is `strict`. */
+export declare const ClientRedirectionPolicyEnum: {
+    readonly AllowAlways: "allow_always";
+    readonly OpenRedirectProtection: "open_redirect_protection";
+};
+export type ClientRedirectionPolicyEnum = (typeof ClientRedirectionPolicyEnum)[keyof typeof ClientRedirectionPolicyEnum];
 /**
  * Refresh token configuration
  */
@@ -2701,6 +2782,12 @@ export interface ClientSigningKey {
  * Signing certificates associated with this client.
  */
 export type ClientSigningKeys = (Management.ClientSigningKey[] | null) | undefined;
+/** Security mode for third-party clients. `strict` enforces enhanced security controls: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. `permissive` preserves pre-existing behavior and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified. */
+export declare const ClientThirdPartySecurityModeEnum: {
+    readonly Strict: "strict";
+    readonly Permissive: "permissive";
+};
+export type ClientThirdPartySecurityModeEnum = (typeof ClientThirdPartySecurityModeEnum)[keyof typeof ClientThirdPartySecurityModeEnum];
 /** Defines the requested authentication method for the token endpoint. Can be `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), or `client_secret_basic` (client uses HTTP Basic). */
 export declare const ClientTokenEndpointAuthMethodEnum: {
     readonly None: "none";
@@ -2729,6 +2816,7 @@ export interface ClientTokenExchangeConfigurationOrNull {
     /** List the enabled token exchange types for this client. */
     allow_any_profile_of_type?: Management.ClientTokenExchangeTypeEnum[] | undefined;
 }
+/** Token exchange type. `on_behalf_of_token_exchange`: enables On-Behalf-Of token exchange (Generally Available). `custom_authentication`: enables custom token exchange profiles (Early Access, requires entitlement). */
 export declare const ClientTokenExchangeTypeEnum: {
     readonly CustomAuthentication: "custom_authentication";
     readonly OnBehalfOfTokenExchange: "on_behalf_of_token_exchange";
@@ -2750,6 +2838,8 @@ export interface ConnectedAccount {
     created_at: string;
     /** ISO 8601 timestamp when the connected account expires. */
     expires_at?: string | undefined;
+    /** The identifier of the organization associated with the connected account. */
+    organization_id?: string | undefined;
 }
 /** The access type for the connected account. */
 export declare const ConnectedAccountAccessTypeEnum: {
@@ -3163,6 +3253,12 @@ export type ConnectionDomainGoogleApps = string;
  * Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided
  */
 export type ConnectionDomainOkta = string;
+/** Algorithm used for DPoP proof JWT signing. */
+export declare const ConnectionDpopSigningAlgEnum: {
+    readonly Es256: "ES256";
+    readonly Ed25519: "Ed25519";
+};
+export type ConnectionDpopSigningAlgEnum = (typeof ConnectionDpopSigningAlgEnum)[keyof typeof ConnectionDpopSigningAlgEnum];
 /**
  * JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.
  */
@@ -3976,6 +4072,7 @@ export interface ConnectionOptionsCommonOidc {
     client_secret?: Management.ConnectionClientSecretOidc | undefined;
     connection_settings?: Management.ConnectionConnectionSettings | undefined;
     domain_aliases?: Management.ConnectionDomainAliases | undefined;
+    dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
@@ -5229,6 +5326,7 @@ export interface ConnectionPropertiesOptions {
     password_no_personal_info?: (Management.ConnectionPasswordNoPersonalInfoOptions | null) | undefined;
     password_dictionary?: (Management.ConnectionPasswordDictionaryOptions | null) | undefined;
     api_enable_users?: boolean | undefined;
+    api_enable_groups?: boolean | undefined;
     basic_profile?: boolean | undefined;
     ext_admin?: boolean | undefined;
     ext_is_suspended?: boolean | undefined;
@@ -6647,6 +6745,8 @@ export interface CreateClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    /** Applies this client grant as the default for all clients in the specified group. The only accepted value is `third_party_clients`, which applies the grant to all third-party clients. Per-client grants for the same audience take precedence. Mutually exclusive with `client_id`. */
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -6742,6 +6842,9 @@ export interface CreateClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -9157,24 +9260,28 @@ export interface EventStreamDeliveryAttempt {
 }
 /** Type of event */
 export declare const EventStreamDeliveryEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamDeliveryEventTypeEnum = (typeof EventStreamDeliveryEventTypeEnum)[keyof typeof EventStreamDeliveryEventTypeEnum];
 /** Delivery status */
@@ -9256,24 +9363,28 @@ export interface EventStreamEventBridgeResponseContent {
     updated_at?: string | undefined;
 }
 export declare const EventStreamEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamEventTypeEnum = (typeof EventStreamEventTypeEnum)[keyof typeof EventStreamEventTypeEnum];
 export type EventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
@@ -9291,24 +9402,28 @@ export interface EventStreamSubscription {
 }
 /** The type of event this test event represents. */
 export declare const EventStreamTestEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamTestEventTypeEnum = (typeof EventStreamTestEventTypeEnum)[keyof typeof EventStreamTestEventTypeEnum];
 export type EventStreamWebhookAuthorizationResponse = Management.EventStreamWebhookBasicAuth | Management.EventStreamWebhookBearerAuth | Management.EventStreamWebhookCustomHeaderAuth;
@@ -12499,6 +12614,8 @@ export interface GetClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    /** Applies this client grant as the default for all clients in the specified group. The only accepted value is `third_party_clients`, which applies the grant to all third-party clients. Per-client grants for the same audience take precedence. Mutually exclusive with `client_id`. */
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -12594,6 +12711,9 @@ export interface GetClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -13506,10 +13626,13 @@ export interface GetTenantSettingsResponseContent {
      */
     skip_non_verifiable_callback_uri_confirmation_prompt?: (boolean | null) | undefined;
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
+    /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
+    client_id_metadata_document_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
 }
 export interface GetTokenExchangeProfileResponseContent {
     /** The unique ID of the token exchange profile. */
@@ -14298,6 +14421,12 @@ export interface ListSelfServiceProfilesPaginatedResponseContent {
     total?: number | undefined;
     self_service_profiles?: Management.SelfServiceProfile[] | undefined;
 }
+export interface ListSynchronizedGroupsResponseContent {
+    /** Array of Google Workspace group ids configured for synchronization. */
+    groups: Management.SynchronizedGroupPayload[];
+    /** The cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListTokenExchangeProfileResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: string | undefined;
@@ -14983,7 +15112,6 @@ export type NetworkAclActionLogEnum = boolean;
 export type NetworkAclActionRedirectEnum = boolean;
 export interface NetworkAclMatch {
     asns?: number[] | undefined;
-    auth0_managed?: string[] | undefined;
     geo_country_codes?: string[] | undefined;
     geo_subdivision_codes?: string[] | undefined;
     ipv4_cidrs?: Management.NetworkAclMatchIpv4Cidr[] | undefined;
@@ -16001,6 +16129,9 @@ export interface RotateClientSecretResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -16840,8 +16971,13 @@ export interface SuspiciousIpThrottlingStage {
 export declare const SynchronizeGroupsEnum: {
     readonly All: "all";
     readonly Off: "off";
+    readonly Selected: "selected";
 };
 export type SynchronizeGroupsEnum = (typeof SynchronizeGroupsEnum)[keyof typeof SynchronizeGroupsEnum];
+export interface SynchronizedGroupPayload {
+    /** Google Workspace Directory group ID. */
+    id: string;
+}
 /**
  * Settings related to OIDC RP-initiated Logout
  */
@@ -16863,6 +16999,12 @@ export declare const TenantSettingsDeviceFlowCharset: {
     readonly Digits: "digits";
 };
 export type TenantSettingsDeviceFlowCharset = (typeof TenantSettingsDeviceFlowCharset)[keyof typeof TenantSettingsDeviceFlowCharset];
+/** Sets the `third_party_security_mode` assigned to clients created via Dynamic Client Registration. `strict` applies enhanced security controls. `permissive` preserves pre-existing behavior and is only available to tenants with prior third-party client usage. */
+export declare const TenantSettingsDynamicClientRegistrationSecurityMode: {
+    readonly Strict: "strict";
+    readonly Permissive: "permissive";
+};
+export type TenantSettingsDynamicClientRegistrationSecurityMode = (typeof TenantSettingsDynamicClientRegistrationSecurityMode)[keyof typeof TenantSettingsDynamicClientRegistrationSecurityMode];
 /**
  * Error page customization.
  */
@@ -17344,6 +17486,8 @@ export interface UpdateClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    /** Applies this client grant as the default for all clients in the specified group. The only accepted value is `third_party_clients`, which applies the grant to all third-party clients. Per-client grants for the same audience take precedence. Mutually exclusive with `client_id`. */
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -17439,6 +17583,9 @@ export interface UpdateClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -17478,6 +17625,7 @@ export interface UpdateConnectionOptions {
     password_no_personal_info?: (Management.ConnectionPasswordNoPersonalInfoOptions | null) | undefined;
     password_dictionary?: (Management.ConnectionPasswordDictionaryOptions | null) | undefined;
     api_enable_users?: boolean | undefined;
+    api_enable_groups?: boolean | undefined;
     basic_profile?: boolean | undefined;
     ext_admin?: boolean | undefined;
     ext_is_suspended?: boolean | undefined;
@@ -18367,10 +18515,13 @@ export interface UpdateTenantSettingsResponseContent {
      */
     skip_non_verifiable_callback_uri_confirmation_prompt?: (boolean | null) | undefined;
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
+    /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
+    client_id_metadata_document_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
 }
 export interface UpdateTokenQuota {
     client_credentials: Management.TokenQuotaClientCredentials;