auth0 5.6.0 → 5.8.0

package/dist/cjs/management/api/types/types.d.ts

@@ -1870,6 +1870,9 @@ export interface Client {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -2444,6 +2447,11 @@ export type ClientExternalMetadataTypeEnum = (typeof ClientExternalMetadataTypeE
  * Optional filter on allow_any_organization.
  */
 export type ClientGrantAllowAnyOrganizationEnum = boolean;
+/** Applies this client grant as the default for all clients in the specified group. The only accepted value is `third_party_clients`, which applies the grant to all third-party clients. Per-client grants for the same audience take precedence. Mutually exclusive with `client_id`. */
+export declare const ClientGrantDefaultForEnum: {
+    readonly ThirdPartyClients: "third_party_clients";
+};
+export type ClientGrantDefaultForEnum = (typeof ClientGrantDefaultForEnum)[keyof typeof ClientGrantDefaultForEnum];
 /** Controls how organizations may be used with this grant */
 export declare const ClientGrantOrganizationNullableUsageEnum: {
     readonly Deny: "deny";
@@ -2470,6 +2478,7 @@ export interface ClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -2536,6 +2545,59 @@ export interface ClientMobileiOs {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** The allowed connection strategy values for the My Organization Configuration. */
+export declare const ClientMyOrganizationConfigurationAllowedStrategiesEnum: {
+    readonly Pingfederate: "pingfederate";
+    readonly Adfs: "adfs";
+    readonly Waad: "waad";
+    readonly GoogleApps: "google-apps";
+    readonly Okta: "okta";
+    readonly Oidc: "oidc";
+    readonly Samlp: "samlp";
+};
+export type ClientMyOrganizationConfigurationAllowedStrategiesEnum = (typeof ClientMyOrganizationConfigurationAllowedStrategiesEnum)[keyof typeof ClientMyOrganizationConfigurationAllowedStrategiesEnum];
+/** The deletion behavior for this client. */
+export declare const ClientMyOrganizationDeletionBehaviorEnum: {
+    readonly Allow: "allow";
+    readonly AllowIfEmpty: "allow_if_empty";
+};
+export type ClientMyOrganizationDeletionBehaviorEnum = (typeof ClientMyOrganizationDeletionBehaviorEnum)[keyof typeof ClientMyOrganizationDeletionBehaviorEnum];
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationPatchConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+}
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationPostConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+}
+/**
+ * Configuration related to the My Organization Configuration for the client.
+ */
+export interface ClientMyOrganizationResponseConfiguration {
+    /** The connection profile ID that this client should validate against. */
+    connection_profile_id?: string | undefined;
+    /** The user attribute profile ID that this client should validate against. */
+    user_attribute_profile_id?: string | undefined;
+    /** The allowed connection strategies for the My Organization Configuration. */
+    allowed_strategies: Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum[];
+    connection_deletion_behavior: Management.ClientMyOrganizationDeletionBehaviorEnum;
+}
 /**
  * Configuration for OIDC backchannel logout initiators
  */
@@ -2618,6 +2680,12 @@ export declare const ClientOrganizationUsagePatchEnum: {
     readonly Require: "require";
 };
 export type ClientOrganizationUsagePatchEnum = (typeof ClientOrganizationUsagePatchEnum)[keyof typeof ClientOrganizationUsagePatchEnum];
+/** Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows. `open_redirect_protection` shows an error page instead of redirecting, and hides the callback domain from email templates. `allow_always` enables standard redirect behavior. Defaults to `open_redirect_protection` for third-party clients. Only applies when `is_first_party` is `false` and `third_party_security_mode` is `strict`. */
+export declare const ClientRedirectionPolicyEnum: {
+    readonly AllowAlways: "allow_always";
+    readonly OpenRedirectProtection: "open_redirect_protection";
+};
+export type ClientRedirectionPolicyEnum = (typeof ClientRedirectionPolicyEnum)[keyof typeof ClientRedirectionPolicyEnum];
 /**
  * Refresh token configuration
  */
@@ -2663,7 +2731,22 @@ export interface ClientSessionTransferConfiguration {
     allow_refresh_token?: boolean | undefined;
     /** Indicates whether Refresh Tokens created during a Native to Web session are tied to that session's lifetime. This determines if such refresh tokens should be automatically revoked when their corresponding sessions are. Usually configured in the web application. Default value is `true`, applicable only in Native to Web SSO context. */
     enforce_online_refresh_tokens?: boolean | undefined;
+    delegation?: (Management.ClientSessionTransferDelegationConfiguration | null) | undefined;
 }
+/**
+ * Configuration for delegation (impersonation) access using Session Transfer Tokens
+ */
+export interface ClientSessionTransferDelegationConfiguration {
+    /** Indicates whether delegation (impersonation) access is allowed using Session Transfer Tokens. Default value is `false`. */
+    allow_delegated_access?: boolean | undefined;
+    enforce_device_binding?: Management.ClientSessionTransferDelegationDeviceBindingEnum | undefined;
+}
+/** Indicates the device binding enforcement for delegation (impersonation) access. If set to 'ip', device binding is enforced by IP. If set to 'asn', device binding is enforced by ASN. Default value is `ip`. */
+export declare const ClientSessionTransferDelegationDeviceBindingEnum: {
+    readonly Ip: "ip";
+    readonly Asn: "asn";
+};
+export type ClientSessionTransferDelegationDeviceBindingEnum = (typeof ClientSessionTransferDelegationDeviceBindingEnum)[keyof typeof ClientSessionTransferDelegationDeviceBindingEnum];
 /** Indicates whether device binding security should be enforced for the app. If set to 'ip', the app will enforce device binding by IP, meaning that consumption of Session Transfer Token must be done from the same IP of the issuer. Likewise, if set to 'asn', device binding is enforced by ASN, meaning consumption of Session Transfer Token must be done from the same ASN as the issuer. If set to 'none', device binding is not enforced. Usually configured in the web application. Default value is `ip`. */
 export declare const ClientSessionTransferDeviceBindingEnum: {
     readonly Ip: "ip";
@@ -2701,6 +2784,12 @@ export interface ClientSigningKey {
  * Signing certificates associated with this client.
  */
 export type ClientSigningKeys = (Management.ClientSigningKey[] | null) | undefined;
+/** Security mode for third-party clients. `strict` enforces enhanced security controls: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. `permissive` preserves pre-existing behavior and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified. */
+export declare const ClientThirdPartySecurityModeEnum: {
+    readonly Strict: "strict";
+    readonly Permissive: "permissive";
+};
+export type ClientThirdPartySecurityModeEnum = (typeof ClientThirdPartySecurityModeEnum)[keyof typeof ClientThirdPartySecurityModeEnum];
 /** Defines the requested authentication method for the token endpoint. Can be `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), or `client_secret_basic` (client uses HTTP Basic). */
 export declare const ClientTokenEndpointAuthMethodEnum: {
     readonly None: "none";
@@ -2729,6 +2818,7 @@ export interface ClientTokenExchangeConfigurationOrNull {
     /** List the enabled token exchange types for this client. */
     allow_any_profile_of_type?: Management.ClientTokenExchangeTypeEnum[] | undefined;
 }
+/** Token exchange type. `on_behalf_of_token_exchange`: enables On-Behalf-Of token exchange (Generally Available). `custom_authentication`: enables custom token exchange profiles (Early Access, requires entitlement). */
 export declare const ClientTokenExchangeTypeEnum: {
     readonly CustomAuthentication: "custom_authentication";
     readonly OnBehalfOfTokenExchange: "on_behalf_of_token_exchange";
@@ -2750,6 +2840,8 @@ export interface ConnectedAccount {
     created_at: string;
     /** ISO 8601 timestamp when the connected account expires. */
     expires_at?: string | undefined;
+    /** The identifier of the organization associated with the connected account. */
+    organization_id?: string | undefined;
 }
 /** The access type for the connected account. */
 export declare const ConnectedAccountAccessTypeEnum: {
@@ -3163,6 +3255,12 @@ export type ConnectionDomainGoogleApps = string;
  * Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided
  */
 export type ConnectionDomainOkta = string;
+/** Algorithm used for DPoP proof JWT signing. */
+export declare const ConnectionDpopSigningAlgEnum: {
+    readonly Es256: "ES256";
+    readonly Ed25519: "Ed25519";
+};
+export type ConnectionDpopSigningAlgEnum = (typeof ConnectionDpopSigningAlgEnum)[keyof typeof ConnectionDpopSigningAlgEnum];
 /**
  * JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.
  */
@@ -3976,6 +4074,7 @@ export interface ConnectionOptionsCommonOidc {
     client_secret?: Management.ConnectionClientSecretOidc | undefined;
     connection_settings?: Management.ConnectionConnectionSettings | undefined;
     domain_aliases?: Management.ConnectionDomainAliases | undefined;
+    dpop_signing_alg?: Management.ConnectionDpopSigningAlgEnum | undefined;
     federated_connections_access_tokens?: (Management.ConnectionFederatedConnectionsAccessTokens | null) | undefined;
     icon_url?: Management.ConnectionIconUrl | undefined;
     id_token_signed_response_algs?: ((Management.ConnectionIdTokenSignedResponseAlgs | undefined) | null) | undefined;
@@ -5229,6 +5328,7 @@ export interface ConnectionPropertiesOptions {
     password_no_personal_info?: (Management.ConnectionPasswordNoPersonalInfoOptions | null) | undefined;
     password_dictionary?: (Management.ConnectionPasswordDictionaryOptions | null) | undefined;
     api_enable_users?: boolean | undefined;
+    api_enable_groups?: boolean | undefined;
     basic_profile?: boolean | undefined;
     ext_admin?: boolean | undefined;
     ext_is_suspended?: boolean | undefined;
@@ -6647,6 +6747,7 @@ export interface CreateClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -6742,6 +6843,9 @@ export interface CreateClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -9157,24 +9261,28 @@ export interface EventStreamDeliveryAttempt {
 }
 /** Type of event */
 export declare const EventStreamDeliveryEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamDeliveryEventTypeEnum = (typeof EventStreamDeliveryEventTypeEnum)[keyof typeof EventStreamDeliveryEventTypeEnum];
 /** Delivery status */
@@ -9256,24 +9364,28 @@ export interface EventStreamEventBridgeResponseContent {
     updated_at?: string | undefined;
 }
 export declare const EventStreamEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamEventTypeEnum = (typeof EventStreamEventTypeEnum)[keyof typeof EventStreamEventTypeEnum];
 export type EventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
@@ -9291,24 +9403,28 @@ export interface EventStreamSubscription {
 }
 /** The type of event this test event represents. */
 export declare const EventStreamTestEventTypeEnum: {
-    readonly UserCreated: "user.created";
-    readonly UserDeleted: "user.deleted";
-    readonly UserUpdated: "user.updated";
+    readonly GroupCreated: "group.created";
+    readonly GroupDeleted: "group.deleted";
+    readonly GroupMemberAdded: "group.member.added";
+    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly GroupRoleAssigned: "group.role.assigned";
+    readonly GroupRoleDeleted: "group.role.deleted";
+    readonly GroupUpdated: "group.updated";
+    readonly OrganizationConnectionAdded: "organization.connection.added";
+    readonly OrganizationConnectionRemoved: "organization.connection.removed";
+    readonly OrganizationConnectionUpdated: "organization.connection.updated";
     readonly OrganizationCreated: "organization.created";
-    readonly OrganizationUpdated: "organization.updated";
     readonly OrganizationDeleted: "organization.deleted";
+    readonly OrganizationGroupRoleAssigned: "organization.group.role.assigned";
+    readonly OrganizationGroupRoleDeleted: "organization.group.role.deleted";
     readonly OrganizationMemberAdded: "organization.member.added";
     readonly OrganizationMemberDeleted: "organization.member.deleted";
     readonly OrganizationMemberRoleAssigned: "organization.member.role.assigned";
     readonly OrganizationMemberRoleDeleted: "organization.member.role.deleted";
-    readonly OrganizationConnectionAdded: "organization.connection.added";
-    readonly OrganizationConnectionUpdated: "organization.connection.updated";
-    readonly OrganizationConnectionRemoved: "organization.connection.removed";
-    readonly GroupCreated: "group.created";
-    readonly GroupUpdated: "group.updated";
-    readonly GroupDeleted: "group.deleted";
-    readonly GroupMemberAdded: "group.member.added";
-    readonly GroupMemberDeleted: "group.member.deleted";
+    readonly OrganizationUpdated: "organization.updated";
+    readonly UserCreated: "user.created";
+    readonly UserDeleted: "user.deleted";
+    readonly UserUpdated: "user.updated";
 };
 export type EventStreamTestEventTypeEnum = (typeof EventStreamTestEventTypeEnum)[keyof typeof EventStreamTestEventTypeEnum];
 export type EventStreamWebhookAuthorizationResponse = Management.EventStreamWebhookBasicAuth | Management.EventStreamWebhookBearerAuth | Management.EventStreamWebhookCustomHeaderAuth;
@@ -12499,6 +12615,7 @@ export interface GetClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -12594,6 +12711,9 @@ export interface GetClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -13506,10 +13626,13 @@ export interface GetTenantSettingsResponseContent {
      */
     skip_non_verifiable_callback_uri_confirmation_prompt?: (boolean | null) | undefined;
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
+    /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
+    client_id_metadata_document_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
 }
 export interface GetTokenExchangeProfileResponseContent {
     /** The unique ID of the token exchange profile. */
@@ -14298,6 +14421,12 @@ export interface ListSelfServiceProfilesPaginatedResponseContent {
     total?: number | undefined;
     self_service_profiles?: Management.SelfServiceProfile[] | undefined;
 }
+export interface ListSynchronizedGroupsResponseContent {
+    /** Array of Google Workspace group ids configured for synchronization. */
+    groups: Management.SynchronizedGroupPayload[];
+    /** The cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+}
 export interface ListTokenExchangeProfileResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: string | undefined;
@@ -14983,7 +15112,6 @@ export type NetworkAclActionLogEnum = boolean;
 export type NetworkAclActionRedirectEnum = boolean;
 export interface NetworkAclMatch {
     asns?: number[] | undefined;
-    auth0_managed?: string[] | undefined;
     geo_country_codes?: string[] | undefined;
     geo_subdivision_codes?: string[] | undefined;
     ipv4_cidrs?: Management.NetworkAclMatchIpv4Cidr[] | undefined;
@@ -16001,6 +16129,9 @@ export interface RotateClientSecretResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -16303,6 +16434,8 @@ export interface SelfServiceProfileSsoTicketConnectionOptions {
  */
 export interface SelfServiceProfileSsoTicketDomainAliasesConfig {
     domain_verification: Management.SelfServiceProfileSsoTicketDomainVerificationEnum;
+    /** List of domains that will be submitted for verification during the self-service SSO flow. */
+    pending_domains?: string[] | undefined;
 }
 /** Whether the end user should complete the domain verification step. Possible values are 'none' (the step is not shown to the user), 'optional' (the user may add a domain alias in the domain verification step) or 'required' (the user must add a domain alias in order to enable the connection). Defaults to 'none'. */
 export declare const SelfServiceProfileSsoTicketDomainVerificationEnum: {
@@ -16311,6 +16444,17 @@ export declare const SelfServiceProfileSsoTicketDomainVerificationEnum: {
     readonly Required: "required";
 };
 export type SelfServiceProfileSsoTicketDomainVerificationEnum = (typeof SelfServiceProfileSsoTicketDomainVerificationEnum)[keyof typeof SelfServiceProfileSsoTicketDomainVerificationEnum];
+/**
+ * Specifies which features are enabled for an "edit connection" ticket. Only applicable when connection ID is provided.
+ */
+export interface SelfServiceProfileSsoTicketEnabledFeatures {
+    /** Whether SSO configuration is enabled in this ticket. */
+    sso?: boolean | undefined;
+    /** Whether domain verification is enabled in this ticket. */
+    domain_verification?: boolean | undefined;
+    /** Whether provisioning configuration is enabled in this ticket. */
+    provisioning?: boolean | undefined;
+}
 export interface SelfServiceProfileSsoTicketEnabledOrganization {
     /** Organization identifier. */
     organization_id: string;
@@ -16840,8 +16984,13 @@ export interface SuspiciousIpThrottlingStage {
 export declare const SynchronizeGroupsEnum: {
     readonly All: "all";
     readonly Off: "off";
+    readonly Selected: "selected";
 };
 export type SynchronizeGroupsEnum = (typeof SynchronizeGroupsEnum)[keyof typeof SynchronizeGroupsEnum];
+export interface SynchronizedGroupPayload {
+    /** Google Workspace Directory group ID. */
+    id: string;
+}
 /**
  * Settings related to OIDC RP-initiated Logout
  */
@@ -16863,6 +17012,12 @@ export declare const TenantSettingsDeviceFlowCharset: {
     readonly Digits: "digits";
 };
 export type TenantSettingsDeviceFlowCharset = (typeof TenantSettingsDeviceFlowCharset)[keyof typeof TenantSettingsDeviceFlowCharset];
+/** Sets the `third_party_security_mode` assigned to clients created via Dynamic Client Registration. `strict` applies enhanced security controls. `permissive` preserves pre-existing behavior and is only available to tenants with prior third-party client usage. */
+export declare const TenantSettingsDynamicClientRegistrationSecurityMode: {
+    readonly Strict: "strict";
+    readonly Permissive: "permissive";
+};
+export type TenantSettingsDynamicClientRegistrationSecurityMode = (typeof TenantSettingsDynamicClientRegistrationSecurityMode)[keyof typeof TenantSettingsDynamicClientRegistrationSecurityMode];
 /**
  * Error page customization.
  */
@@ -17344,6 +17499,7 @@ export interface UpdateClientGrantResponseContent {
     organization_usage?: Management.ClientGrantOrganizationUsageEnum | undefined;
     /** If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations. */
     allow_any_organization?: boolean | undefined;
+    default_for?: Management.ClientGrantDefaultForEnum | undefined;
     /** If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly. */
     is_system?: boolean | undefined;
     subject_type?: Management.ClientGrantSubjectTypeEnum | undefined;
@@ -17439,6 +17595,9 @@ export interface UpdateClientResponseContent {
     par_request_expiry?: (number | null) | undefined;
     token_quota?: Management.TokenQuota | undefined;
     express_configuration?: Management.ExpressConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
@@ -17478,6 +17637,7 @@ export interface UpdateConnectionOptions {
     password_no_personal_info?: (Management.ConnectionPasswordNoPersonalInfoOptions | null) | undefined;
     password_dictionary?: (Management.ConnectionPasswordDictionaryOptions | null) | undefined;
     api_enable_users?: boolean | undefined;
+    api_enable_groups?: boolean | undefined;
     basic_profile?: boolean | undefined;
     ext_admin?: boolean | undefined;
     ext_is_suspended?: boolean | undefined;
@@ -18367,10 +18527,13 @@ export interface UpdateTenantSettingsResponseContent {
      */
     skip_non_verifiable_callback_uri_confirmation_prompt?: (boolean | null) | undefined;
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
+    /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
+    client_id_metadata_document_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
     enable_ai_guide?: boolean | undefined;
+    dynamic_client_registration_security_mode?: Management.TenantSettingsDynamicClientRegistrationSecurityMode | undefined;
 }
 export interface UpdateTokenQuota {
     client_credentials: Management.TokenQuotaClientCredentials;