auth0 7.1.0 → 7.3.0

package/dist/esm/management/api/requests/requests.d.mts

@@ -347,6 +347,7 @@ export interface CreateClientRequestContent {
     b2b_integration_configuration?: Management.B2BIntegrationConfiguration;
     my_organization_configuration?: Management.ClientMyOrganizationPostConfiguration;
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration;
+    oidc_support?: Management.ClientOidcSupportPost;
 }
 /**
  * @example
@@ -1467,8 +1468,11 @@ export interface CreateResourceServerRequestContent {
     skip_consent_for_verifiable_first_party_clients?: boolean;
     /** Whether to enforce authorization policies (true) or to ignore them (false). */
     enforce_policies?: boolean;
+    access_token?: Management.ResourceServerAccessToken | null;
     token_encryption?: Management.ResourceServerTokenEncryption | null;
     consent_policy?: Management.ResourceServerConsentPolicyEnum | null;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean;
     authorization_details?: unknown[] | null;
     proof_of_possession?: Management.ResourceServerProofOfPossession | null;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization;
@@ -1539,8 +1543,11 @@ export interface UpdateResourceServerRequestContent {
     token_dialect?: Management.ResourceServerTokenDialectSchemaEnum;
     /** Whether authorization policies are enforced (true) or not enforced (false). */
     enforce_policies?: boolean;
+    access_token?: Management.ResourceServerAccessToken | null;
     token_encryption?: Management.ResourceServerTokenEncryption | null;
     consent_policy?: Management.ResourceServerConsentPolicyEnum | null;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean;
     authorization_details?: unknown[] | null;
     proof_of_possession?: Management.ResourceServerProofOfPossession | null;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization;
@@ -1896,8 +1903,8 @@ export interface ListUserBlocksByIdentifierRequestParameters {
     /** Should be any of a username, phone number, or email. */
     identifier: string;
     /**
-     *           If true and Brute Force Protection is enabled and configured to block logins, will return a list of blocked IP addresses.
-     *           If true and Brute Force Protection is disabled, will return an empty list.
+     *           If true, returns only blocks that are currently enforced (e.g. subject to protection status, IP allowlist, etc.).
+     *           If false or omitted, returns all blocks regardless of enforcement state.
      *
      */
     consider_brute_force_enablement?: boolean | null;
@@ -1920,8 +1927,8 @@ export interface DeleteUserBlocksByIdentifierRequestParameters {
  */
 export interface ListUserBlocksRequestParameters {
     /**
-     *           If true and Brute Force Protection is enabled and configured to block logins, will return a list of blocked IP addresses.
-     *           If true and Brute Force Protection is disabled, will return an empty list.
+     *           If true, returns only blocks that are currently enforced (e.g. subject to protection status, IP allowlist, etc.).
+     *           If false or omitted, returns all blocks regardless of enforcement state.
      *
      */
     consider_brute_force_enablement?: boolean | null;
@@ -2822,6 +2829,71 @@ export interface CreateEventStreamRedeliveryRequestContent {
     /** Filter by event type */
     event_types?: Management.EventStreamEventTypeEnum[];
 }
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         status: "draft",
+ *         authentication_flow: "authentication_flow",
+ *         feature_flag_id: "feature_flag_id"
+ *     }
+ */
+export interface ListExperimentsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of experiments to return per page. Defaults to 25, maximum 50. */
+    take?: number | null;
+    /** Filter by status. Exact match. */
+    status?: Management.ExperimentStatusEnum | null;
+    /** Filter by authentication flow. Exact match. */
+    authentication_flow?: string | null;
+    /** Filter by feature flag ID. Exact match. */
+    feature_flag_id?: string | null;
+}
+/**
+ * @example
+ *     {
+ *         name: "name",
+ *         feature_flag_id: "feature_flag_id",
+ *         authentication_flow: "authentication"
+ *     }
+ */
+export interface CreateExperimentRequestContent {
+    /** A human-readable name for the experiment */
+    name: string;
+    /** A description of the experiment */
+    description?: string;
+    /** The ID of the feature flag this experiment is based on */
+    feature_flag_id: string;
+    authentication_flow: Management.AuthenticationFlowEnum;
+    /** Applies only to Auth0-managed flags. Controls where non-overridden config keys resolve from: 'tenant' inherits the tenant's live config so the experiment overlays only its changes, 'flag' uses the flag's frozen defaults for a complete config. Optional; defaults to 'tenant' when omitted. Rejected for customer-defined flags. */
+    default_config?: Management.DefaultConfigEnum;
+    /** The traffic allocation strategy for this experiment */
+    allocation_strategy?: Management.AllocationStrategyEnum;
+    /** Traffic allocations mapping variations to weights or segments */
+    allocations?: Management.AllocationRequestItem[];
+    /** Ramp experiment levels configuration. A strictly-increasing sequence of exposure percentages, each an integer in [0, 100]. */
+    levels?: number[];
+}
+/**
+ * @example
+ *     {}
+ */
+export interface UpdateExperimentRequestParameters {
+    /** A human-readable name for the experiment */
+    name?: string;
+    /** A description of the experiment */
+    description?: string | null;
+    /** Specifies the target authentication flow for this experiment. This field can only be modified on draft experiments. Must be one of: authentication, mfa_enrollment, mfa_challenge, password_reset, passkey_enrollment, or all. Note that the all value targets every flow at once, but requires that this is the only active experiment. */
+    authentication_flow?: Management.AuthenticationFlowEnum;
+    /** Replaces all traffic allocations. Cannot be modified while the experiment is active. */
+    allocations?: Management.AllocationRequestItem[];
+    /** Applies only to Auth0-managed flags. Controls where non-overridden config keys resolve from: 'tenant' inherits the tenant's live config, 'flag' uses the flag's frozen defaults. Can only be modified on draft experiments. Rejected for customer-defined flags. */
+    default_config?: Management.DefaultConfigEnum;
+    /** Ramp experiment levels configuration. A strictly-increasing sequence of exposure percentages, each an integer in [0, 100]. Can only be modified on draft experiments. */
+    levels?: number[];
+}
 /**
  * @example
  *     {
@@ -2832,6 +2904,140 @@ export interface AdvanceRampRequestContent {
     /** The target percentage level from the experiment schedule. Must be the immediate next level. */
     target_level: number;
 }
+/**
+ * @example
+ *     {
+ *         status: "active"
+ *     }
+ */
+export interface UpdateExperimentStatusRequestContent {
+    status: Management.ExperimentTransitionStatusEnum;
+}
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         type: "auth0",
+ *         status: "draft"
+ *     }
+ */
+export interface ListFeatureFlagsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of feature flags to return per page. Defaults to 25, maximum 50. */
+    take?: number | null;
+    /** Filter by type. Exact match. */
+    type?: Management.FeatureFlagTypeEnum | null;
+    /** Filter by status. Exact match. */
+    status?: Management.FeatureFlagStatusEnum | null;
+}
+/**
+ * @example
+ *     {
+ *         name: "name",
+ *         parameters: {}
+ *     }
+ */
+export interface CreateFeatureFlagRequestContent {
+    /** A human-readable name for the feature flag */
+    name: string;
+    /** A description of what this feature flag controls */
+    description?: string;
+    parameters: Management.CreateFeatureFlagParameters;
+}
+/**
+ * @example
+ *     {}
+ */
+export interface UpdateFeatureFlagRequestContent {
+    /** A human-readable name for the feature flag */
+    name?: string;
+    /** A description of what this feature flag controls */
+    description?: string | null;
+    parameters?: Management.UpdateFeatureFlagParameters;
+}
+/**
+ * @example
+ *     {
+ *         status: "draft"
+ *     }
+ */
+export interface UpdateFeatureFlagStatusRequestContent {
+    /** The target status to transition the feature flag to. */
+    status: Management.FeatureFlagStatusEnum;
+}
+/**
+ * @example
+ *     {
+ *         from: "from",
+ *         take: 1,
+ *         type: "auth0"
+ *     }
+ */
+export interface ListSegmentsRequestParameters {
+    /** Optional Id from which to start selection. */
+    from?: string | null;
+    /** Number of segments to return per page. Defaults to 25, maximum 50. */
+    take?: number | null;
+    /** Filter by type. Exact match. */
+    type?: Management.SegmentTypeFilterEnum | null;
+}
+/**
+ * @example
+ *     {
+ *         name: "name",
+ *         rules: [{}]
+ *     }
+ */
+export interface CreateSegmentRequestContent {
+    /** A human-readable name for the segment */
+    name: string;
+    /** A description of the segment */
+    description?: string;
+    /** An ordered list of rules. A segment matches if any rule matches. Each rule is limited to 4KB and the whole segment to 10KB (serialized). */
+    rules: Management.SegmentRule[];
+}
+/**
+ * @example
+ *     {}
+ */
+export interface UpdateSegmentRequestContent {
+    /** A human-readable name for the segment */
+    name?: string;
+    /** A description of the segment */
+    description?: string | null;
+    /** Replaces the entire rules array. Each rule is limited to 4KB and the whole segment to 10KB (serialized). */
+    rules?: Management.SegmentRule[];
+}
+/**
+ * @example
+ *     {
+ *         name: "name",
+ *         overrides: {
+ *             "key": "value"
+ *         }
+ *     }
+ */
+export interface CreateVariationRequestContent {
+    /** A human-readable name for the variation */
+    name: string;
+    /** A description of what this variation controls */
+    description?: string;
+    /** Configuration overrides for this variation; keys must exist in the parent flag parameters. Empty {} is the baseline (control) variation that overrides nothing. */
+    overrides: Management.VariationOverridesMap;
+}
+/**
+ * @example
+ *     {}
+ */
+export interface UpdateVariationRequestContent {
+    /** A human-readable name for the variation */
+    name?: string;
+    /** A description of what this variation controls */
+    description?: string | null;
+    overrides?: Management.UpdateVariationOverridesMap;
+}
 /**
  * @example
  *     {
@@ -3389,6 +3595,7 @@ export interface CreateOrganizationAllConnectionRequestParameters {
     /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
     is_signup_enabled?: boolean;
     organization_access_level?: Management.OrganizationAccessLevelEnum;
+    organization_member_access_level?: Management.OrganizationMemberAccessLevelEnum;
     /** Whether the connection is enabled for the organization. */
     is_enabled?: boolean;
     /** Connection identifier. */
@@ -3408,6 +3615,7 @@ export interface UpdateOrganizationConnectionRequestParameters {
     /** Determines whether organization signup should be enabled for this organization connection. Only applicable for database connections. Default: false. */
     is_signup_enabled?: boolean;
     organization_access_level?: Management.OrganizationAccessLevelEnumWithNull | null;
+    organization_member_access_level?: Management.OrganizationMemberAccessLevelEnumWithNull | null;
     /** Whether the connection is enabled for the organization. */
     is_enabled?: boolean | null;
 }
@@ -4005,6 +4213,7 @@ export interface UpdateTenantSettingsRequestContent {
     default_redirection_uri?: string;
     /** Supported locales for the user interface */
     enabled_locales?: Management.TenantSettingsSupportedLocalesEnum[];
+    access_token?: Management.ResourceServerAccessToken | null;
     security_headers?: Management.TenantSettingsNullableSecurityHeaders | null;
     session_cookie?: Management.SessionCookieSchema | null;
     sessions?: Management.TenantSettingsSessions | null;

package/dist/esm/management/api/resources/experimentation/client/Client.d.mts

@@ -1,12 +1,18 @@
 import type { BaseClientOptions } from "../../../../BaseClient.mjs";
 import { type NormalizedClientOptionsWithAuth } from "../../../../BaseClient.mjs";
 import { ExperimentsClient } from "../resources/experiments/client/Client.mjs";
+import { FeatureFlagsClient } from "../resources/featureFlags/client/Client.mjs";
+import { SegmentsClient } from "../resources/segments/client/Client.mjs";
 export declare namespace ExperimentationClient {
     type Options = BaseClientOptions;
 }
 export declare class ExperimentationClient {
     protected readonly _options: NormalizedClientOptionsWithAuth<ExperimentationClient.Options>;
     protected _experiments: ExperimentsClient | undefined;
+    protected _featureFlags: FeatureFlagsClient | undefined;
+    protected _segments: SegmentsClient | undefined;
     constructor(options: ExperimentationClient.Options);
     get experiments(): ExperimentsClient;
+    get featureFlags(): FeatureFlagsClient;
+    get segments(): SegmentsClient;
 }

package/dist/esm/management/api/resources/experimentation/client/Client.mjs

@@ -1,6 +1,8 @@
 // This file was auto-generated by Fern from our API Definition.
 import { normalizeClientOptionsWithAuth } from "../../../../BaseClient.mjs";
 import { ExperimentsClient } from "../resources/experiments/client/Client.mjs";
+import { FeatureFlagsClient } from "../resources/featureFlags/client/Client.mjs";
+import { SegmentsClient } from "../resources/segments/client/Client.mjs";
 export class ExperimentationClient {
     constructor(options) {
         this._options = normalizeClientOptionsWithAuth(options);
@@ -9,4 +11,12 @@ export class ExperimentationClient {
         var _a;
         return ((_a = this._experiments) !== null && _a !== void 0 ? _a : (this._experiments = new ExperimentsClient(this._options)));
     }
+    get featureFlags() {
+        var _a;
+        return ((_a = this._featureFlags) !== null && _a !== void 0 ? _a : (this._featureFlags = new FeatureFlagsClient(this._options)));
+    }
+    get segments() {
+        var _a;
+        return ((_a = this._segments) !== null && _a !== void 0 ? _a : (this._segments = new SegmentsClient(this._options)));
+    }
 }

package/dist/esm/management/api/resources/experimentation/resources/experiments/client/Client.d.mts

@@ -10,6 +10,101 @@ export declare namespace ExperimentsClient {
 export declare class ExperimentsClient {
     protected readonly _options: NormalizedClientOptionsWithAuth<ExperimentsClient.Options>;
     constructor(options: ExperimentsClient.Options);
+    /**
+     * Retrieve a paginated list of experiments for the tenant, with optional filters.
+     *
+     * @param {Management.ListExperimentsRequestParameters} request
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.list({
+     *         from: "from",
+     *         take: 1,
+     *         status: "draft",
+     *         authentication_flow: "authentication_flow",
+     *         feature_flag_id: "feature_flag_id"
+     *     })
+     */
+    list(request?: Management.ListExperimentsRequestParameters, requestOptions?: ExperimentsClient.RequestOptions): Promise<core.Page<Management.ExperimentListItem, Management.ListExperimentsResponseContent>>;
+    /**
+     * Create a new experiment for A/B testing.
+     *
+     * @param {Management.CreateExperimentRequestContent} request
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.ConflictError}
+     * @throws {@link Management.UnprocessableEntityError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.create({
+     *         name: "name",
+     *         feature_flag_id: "feature_flag_id",
+     *         authentication_flow: "authentication"
+     *     })
+     */
+    create(request: Management.CreateExperimentRequestContent, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.CreateExperimentResponseContent>;
+    private __create;
+    /**
+     * Retrieve a single experiment with its allocations by ID.
+     *
+     * @param {string} id - The ID of the experiment to retrieve.
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.get("id")
+     */
+    get(id: string, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.GetExperimentResponseContent>;
+    private __get;
+    /**
+     * Permanently delete an experiment and its allocations by ID. Active experiments cannot be deleted; pause or complete first. Idempotent: returns 204 even if the experiment does not exist.
+     *
+     * @param {string} id - The ID of the experiment to delete.
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.delete("id")
+     */
+    delete(id: string, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<void>;
+    private __delete;
+    /**
+     * Partially update an experiment by ID. Only provided fields are updated. Providing allocations replaces the entire allocations set.
+     *
+     * @param {string} id - The ID of the experiment to update.
+     * @param {Management.UpdateExperimentRequestParameters} request
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.ConflictError}
+     * @throws {@link Management.UnprocessableEntityError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.update("id")
+     */
+    update(id: string, request?: Management.UpdateExperimentRequestParameters, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.UpdateExperimentResponseContent>;
+    private __update;
     /**
      * Increments the current ramp index to the requested target level. Up-only: the target must be the immediate next level in the schedule. Idempotent: calling with the current level returns success without writing anything.
      *
@@ -31,4 +126,42 @@ export declare class ExperimentsClient {
      */
     advanceRamp(id: string, request: Management.AdvanceRampRequestContent, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.AdvanceRampResponseContent>;
     private __advanceRamp;
+    /**
+     * Transitions an experiment through its lifecycle: draft → active, active → paused, paused → active, active/paused → completed. Activation runs full readiness validation.
+     *
+     * @param {string} id - The ID of the experiment to transition.
+     * @param {Management.UpdateExperimentStatusRequestContent} request
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.ConflictError}
+     * @throws {@link Management.UnprocessableEntityError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.updateStatus("id", {
+     *         status: "active"
+     *     })
+     */
+    updateStatus(id: string, request: Management.UpdateExperimentStatusRequestContent, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.UpdateExperimentStatusResponseContent>;
+    private __updateStatus;
+    /**
+     * Checks whether an experiment is ready to be activated. Returns is_valid boolean and an errors array describing any blockers. Read-only; no state is modified.
+     *
+     * @param {string} id - The ID of the experiment to validate.
+     * @param {ExperimentsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.TooManyRequestsError}
+     *
+     * @example
+     *     await client.experimentation.experiments.validate("id")
+     */
+    validate(id: string, requestOptions?: ExperimentsClient.RequestOptions): core.HttpResponsePromise<Management.ValidateExperimentResponseContent>;
+    private __validate;
 }