auth0 7.2.0 → 7.3.0

package/dist/cjs/management/api/types/types.d.ts

@@ -252,9 +252,18 @@ export declare const OauthScope: {
     /**
      * Read Events */
     readonly ReadEvents: "read:events";
+    /**
+     * Create Experimentation */
+    readonly CreateExperimentation: "create:experimentation";
+    /**
+     * Read Experimentation */
+    readonly ReadExperimentation: "read:experimentation";
     /**
      * Update Experimentation */
     readonly UpdateExperimentation: "update:experimentation";
+    /**
+     * Delete Experimentation */
+    readonly DeleteExperimentation: "delete:experimentation";
     /**
      * Create Flows */
     readonly CreateFlows: "create:flows";
@@ -735,9 +744,6 @@ export declare const OauthScope: {
     /**
      * Delete Organization Client Associations */
     readonly DeleteOrganizationClients: "delete:organization_clients";
-    /**
-     * Read Organization Templates */
-    readonly ReadOrganizationTemplates: "read:organization_templates";
     /**
      * Create Network ACL Keys */
     readonly CreateNetworkAclKeys: "create:network_acl_keys";
@@ -1323,6 +1329,37 @@ export interface AgentResponseContent {
     external_agent_id?: string | undefined;
     metadata: Management.AgentMetadata;
 }
+export interface AllocationItem {
+    variation_id?: string | undefined;
+    variation_name?: string | undefined;
+    segment_id?: string | undefined;
+    segment_name?: string | undefined;
+    weight?: number | undefined;
+    priority?: number | undefined;
+    is_control?: boolean | undefined;
+    is_fallback?: boolean | undefined;
+    variation_snapshot?: (Record<string, unknown> | null) | undefined;
+    segment_snapshot?: (Record<string, unknown> | null) | undefined;
+}
+export interface AllocationRequestItem {
+    /** The ID of the variation to allocate */
+    variation_id: string;
+    /** Percentage weight for this allocation (percentage strategy only) */
+    weight?: number | undefined;
+    /** The segment this allocation targets (segment strategy only) */
+    segment_id?: string | undefined;
+    /** Evaluation order; 1 = highest priority (segment strategy only) */
+    priority?: number | undefined;
+    /** Whether this allocation is the control group */
+    is_control: boolean;
+    /** Whether this allocation is the default fallback (segment strategy only) */
+    is_fallback?: boolean | undefined;
+}
+export declare const AllocationStrategyEnum: {
+    readonly Percentage: "percentage";
+    readonly Segment: "segment";
+};
+export type AllocationStrategyEnum = (typeof AllocationStrategyEnum)[keyof typeof AllocationStrategyEnum];
 /**
  * IP address to check.
  */
@@ -1359,6 +1396,7 @@ export interface AssociateOrganizationClientGrantResponseContent {
 export declare const AsyncApprovalNotificationsChannelsEnum: {
     readonly GuardianPush: "guardian-push";
     readonly Email: "email";
+    readonly MyAccount: "my-account";
 };
 export type AsyncApprovalNotificationsChannelsEnum = (typeof AsyncApprovalNotificationsChannelsEnum)[keyof typeof AsyncApprovalNotificationsChannelsEnum];
 export interface AttackProtectionCaptchaArkoseResponseContent {
@@ -1459,6 +1497,16 @@ export interface AttackProtectionUpdateCaptchaRecaptchaV2 {
     /** The secret key for the reCAPTCHA v2 provider. */
     secret: string;
 }
+/** Specifies the target authentication flow for this experiment. Must be one of: authentication, mfa_enrollment, mfa_challenge, password_reset, passkey_enrollment, or all. Note that the all value targets every flow at once, but requires that this is the only active experiment. */
+export declare const AuthenticationFlowEnum: {
+    readonly Authentication: "authentication";
+    readonly MfaEnrollment: "mfa_enrollment";
+    readonly MfaChallenge: "mfa_challenge";
+    readonly PasswordReset: "password_reset";
+    readonly PasskeyEnrollment: "passkey_enrollment";
+    readonly All: "all";
+};
+export type AuthenticationFlowEnum = (typeof AuthenticationFlowEnum)[keyof typeof AuthenticationFlowEnum];
 export declare const AuthenticationMethodTypeEnum: {
     readonly RecoveryCode: "recovery-code";
     readonly Totp: "totp";
@@ -2501,11 +2549,11 @@ export declare const ClientAppTypeEnum: {
 };
 export type ClientAppTypeEnum = (typeof ClientAppTypeEnum)[keyof typeof ClientAppTypeEnum];
 /**
- * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
+ * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`, `my-account`.
  */
 export type ClientAsyncApprovalNotificationsChannelsApiPatchConfiguration = (Management.AsyncApprovalNotificationsChannelsEnum[] | null) | undefined;
 /**
- * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
+ * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`, `my-account`.
  */
 export type ClientAsyncApprovalNotificationsChannelsApiPostConfiguration = Management.AsyncApprovalNotificationsChannelsEnum[];
 /**
@@ -2873,6 +2921,7 @@ export declare const ClientOidcBackchannelLogoutInitiatorsEnum: {
     readonly EmailIdentifierChanged: "email-identifier-changed";
     readonly MfaPhoneUnenrolled: "mfa-phone-unenrolled";
     readonly AccountDeactivated: "account-deactivated";
+    readonly ProfileChanged: "profile-changed";
 };
 export type ClientOidcBackchannelLogoutInitiatorsEnum = (typeof ClientOidcBackchannelLogoutInitiatorsEnum)[keyof typeof ClientOidcBackchannelLogoutInitiatorsEnum];
 /** The `mode` property determines the configuration method for enabling initiators. `custom` enables only the initiators listed in the selected_initiators array, `all` enables all current and future initiators. */
@@ -2901,6 +2950,21 @@ export interface ClientOidcBackchannelLogoutSettings {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export declare const ClientOidcSupportAllowedScopesEnum: {
+    readonly Profile: "profile";
+    readonly Email: "email";
+    readonly Address: "address";
+    readonly Phone: "phone";
+};
+export type ClientOidcSupportAllowedScopesEnum = (typeof ClientOidcSupportAllowedScopesEnum)[keyof typeof ClientOidcSupportAllowedScopesEnum];
+/**
+ * OIDC support configuration for a client. Controls whether OIDC flows are allowed and which scopes the client may request.
+ */
+export interface ClientOidcSupportPost {
+    is_allowed: boolean;
+    allow_all_scopes?: boolean | undefined;
+    allowed_scopes?: Management.ClientOidcSupportAllowedScopesEnum[] | undefined;
+}
 /** Method for discovering organizations during the `pre_login_prompt`. `email` allows users to find their organization by entering their email address and performing domain matching, while `organization_name` requires users to enter the organization name directly. These methods can be combined. */
 export declare const ClientOrganizationDiscoveryEnum: {
     readonly Email: "email";
@@ -3521,12 +3585,6 @@ export type ConnectionDecryptionKeySaml =
 /**
  * Private key in PEM format. */
  | string;
-/** Controls whether connections created from this template can be deleted. */
-export declare const ConnectionDeletionBehaviorEnum: {
-    readonly Allow: "allow";
-    readonly AllowIfEmpty: "allow_if_empty";
-};
-export type ConnectionDeletionBehaviorEnum = (typeof ConnectionDeletionBehaviorEnum)[keyof typeof ConnectionDeletionBehaviorEnum];
 /**
  * The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.
  */
@@ -4146,6 +4204,7 @@ export interface ConnectionOptionsAd extends Management.ConnectionOptionsCommon
     signInEndpoint?: Management.ConnectionSignInEndpointAd | undefined;
     tenant_domain?: Management.ConnectionTenantDomainAd | undefined;
     thumbprints?: Management.ConnectionThumbprintsAd | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384Ad | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -4167,6 +4226,7 @@ export interface ConnectionOptionsAdfs extends Management.ConnectionOptionsCommo
     signInEndpoint?: Management.ConnectionSignInEndpointAdfs | undefined;
     tenant_domain?: Management.ConnectionTenantDomain | undefined;
     thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */
     user_id_attribute?: string | undefined;
@@ -4360,6 +4420,7 @@ export interface ConnectionOptionsAzureAd extends Management.ConnectionOptionsCo
     tenant_domain?: Management.ConnectionTenantDomainAzureAdOne | undefined;
     tenantId?: Management.ConnectionTenantIdAzureAd | undefined;
     thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect. */
     use_wsfed?: boolean | undefined;
@@ -4476,6 +4537,7 @@ export interface ConnectionOptionsCommonSaml {
     signatureAlgorithm?: Management.ConnectionSignatureAlgorithmSaml | undefined;
     tenant_domain?: Management.ConnectionTenantDomainSaml | undefined;
     thumbprints?: Management.ConnectionThumbprintsSaml | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384Saml | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
 }
 /**
@@ -5801,6 +5863,8 @@ export interface ConnectionPropertiesOptions {
     useOauthSpecScope?: Management.ConnectionUseOauthSpecScope | undefined;
     discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined;
     oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined;
+    thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -6930,7 +6994,7 @@ export type ConnectionTenantDomainSaml = string;
  */
 export type ConnectionTenantIdAzureAd = string;
 /**
- * Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.
+ * Array of certificate thumbprints (SHA-128 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.
  */
 export type ConnectionThumbprints = string[];
 /**
@@ -6941,6 +7005,18 @@ export type ConnectionThumbprintsAd = Management.ConnectionSha1Thumbprint[];
  * SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.
  */
 export type ConnectionThumbprintsSaml = Management.ConnectionSha1Thumbprint[];
+/**
+ * Array of certificate thumbprints (SHA-384 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a 96-character hexadecimal string.
+ */
+export type ConnectionThumbprintsSha384 = string[];
+/**
+ * Array of certificate SHA-384 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.
+ */
+export type ConnectionThumbprintsSha384Ad = string[];
+/**
+ * SHA-384 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 96-character hexadecimal string.
+ */
+export type ConnectionThumbprintsSha384Saml = string[];
 /**
  * URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.
  */
@@ -8427,6 +8503,30 @@ export interface CreateEventStreamWebHookRequestContent {
     destination: Management.EventStreamWebhookDestination;
     status?: Management.EventStreamStatusEnum | undefined;
 }
+export interface CreateExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateExportUsersFields {
     /** Name of the field in the profile. */
     name: string;
@@ -8452,6 +8552,20 @@ export interface CreateExportUsersResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Configuration parameters for this feature flag
+ */
+export type CreateFeatureFlagParameters = Record<string, Management.FeatureFlagConfigParam>;
+export interface CreateFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateFlowResponseContent {
     id: string;
     name: string;
@@ -9117,6 +9231,8 @@ export interface CreateResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -9185,6 +9301,15 @@ export interface CreateScimTokenResponseContent {
     /** The token's valid until at timestamp */
     valid_until?: string | undefined;
 }
+export interface CreateSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -9322,6 +9447,15 @@ export interface CreateUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface CreateVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -9624,6 +9758,12 @@ export interface DailyStats {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** For Auth0-managed flags, where non-overridden config keys resolve from: 'tenant' inherits the tenant's live config, 'flag' uses the flag's frozen defaults. Omitted when unset (defaults to 'tenant' at resolution). Not applicable to customer-defined flags. */
+export declare const DefaultConfigEnum: {
+    readonly Tenant: "tenant";
+    readonly Flag: "flag";
+};
+export type DefaultConfigEnum = (typeof DefaultConfigEnum)[keyof typeof DefaultConfigEnum];
 /** Default authentication method for email identifier */
 export declare const DefaultMethodEmailIdentifierEnum: {
     readonly Password: "password";
@@ -24173,6 +24313,53 @@ export interface EventStreamWebhookResponseContent {
     /** Timestamp when the event stream was last updated. */
     updated_at?: string | undefined;
 }
+export interface ExperimentListItem {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+/** Filter by status. Exact match. */
+export declare const ExperimentStatusEnum: {
+    readonly Draft: "draft";
+    readonly Active: "active";
+    readonly Paused: "paused";
+    readonly Completed: "completed";
+    readonly Archived: "archived";
+};
+export type ExperimentStatusEnum = (typeof ExperimentStatusEnum)[keyof typeof ExperimentStatusEnum];
+/** The target status to transition the experiment to. */
+export declare const ExperimentTransitionStatusEnum: {
+    readonly Active: "active";
+    readonly Paused: "paused";
+    readonly Completed: "completed";
+    readonly Archived: "archived";
+};
+export type ExperimentTransitionStatusEnum = (typeof ExperimentTransitionStatusEnum)[keyof typeof ExperimentTransitionStatusEnum];
+export interface ExperimentValidationError {
+    /** Machine-readable error code identifying the validation failure. */
+    code: string;
+    /** Human-readable description of the validation failure. */
+    message: string;
+}
 /**
  * Application specific configuration for use with the OIN Express Configuration feature.
  */
@@ -24221,6 +24408,48 @@ export interface ExpressConfigurationOrNull {
 }
 export interface ExtensibilityEmailProviderCredentials {
 }
+export interface FeatureFlag {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface FeatureFlagConfigParam {
+    type: Management.FeatureFlagConfigParamTypeEnum;
+    value?: unknown | undefined;
+    /** A human-readable description of the parameter */
+    description?: string | undefined;
+}
+/** The data type of the parameter value */
+export declare const FeatureFlagConfigParamTypeEnum: {
+    readonly String: "string";
+    readonly Boolean: "boolean";
+    readonly Number: "number";
+    readonly Array: "array";
+    readonly Object: "object";
+};
+export type FeatureFlagConfigParamTypeEnum = (typeof FeatureFlagConfigParamTypeEnum)[keyof typeof FeatureFlagConfigParamTypeEnum];
+/**
+ * Configuration parameters for this feature flag
+ */
+export type FeatureFlagConfigParams = Record<string, Management.FeatureFlagConfigParam>;
+/** Filter by status. Exact match. */
+export declare const FeatureFlagStatusEnum: {
+    readonly Draft: "draft";
+    readonly Active: "active";
+    readonly Archived: "archived";
+};
+export type FeatureFlagStatusEnum = (typeof FeatureFlagStatusEnum)[keyof typeof FeatureFlagStatusEnum];
+/** Filter by type. Exact match. */
+export declare const FeatureFlagTypeEnum: {
+    readonly Auth0: "auth0";
+    readonly Self: "self";
+};
+export type FeatureFlagTypeEnum = (typeof FeatureFlagTypeEnum)[keyof typeof FeatureFlagTypeEnum];
 /**
  * Configure FedCM login settings for New Universal Login
  */
@@ -27657,6 +27886,40 @@ export interface GetEventStreamDeliveryHistoryResponseContent {
     event?: Management.EventStreamCloudEvent | undefined;
 }
 export type GetEventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
+export interface GetExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface GetFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export declare const GetFlowExecutionRequestParametersHydrateEnum: {
     readonly Debug: "debug";
 };
@@ -28206,6 +28469,8 @@ export interface GetResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -28272,6 +28537,15 @@ export interface GetScimConfigurationResponseContent {
  * The list of scim tokens for scim clients
  */
 export type GetScimTokensResponseContent = Management.ScimTokenItem[];
+export interface GetSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface GetSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -28571,6 +28845,15 @@ export interface GetUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface GetVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface GetVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -29110,6 +29393,16 @@ export interface ListEventStreamsResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface ListExperimentsResponseContent {
+    experiments: Management.ExperimentListItem[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
+export interface ListFeatureFlagsResponseContent {
+    feature_flags: Management.FeatureFlag[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
 export interface ListFlowExecutionsPaginatedResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: string | undefined;
@@ -29307,6 +29600,11 @@ export interface ListScimConfigurationsResponseContent {
     /** The cursor to be used as the "from" query parameter for the next page of results. */
     next?: string | undefined;
 }
+export interface ListSegmentsResponseContent {
+    segments: Management.Segment[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
 /**
  * The list of custom text keys and values.
  */
@@ -29419,6 +29717,9 @@ export interface ListUsersOffsetPaginatedResponseContent {
     total?: number | undefined;
     users?: Management.UserResponseSchema[] | undefined;
 }
+export interface ListVariationsResponseContent {
+    variations: Management.Variation[];
+}
 export interface ListVerifiableCredentialTemplatesPaginatedResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: (string | null) | undefined;
@@ -30286,12 +30587,6 @@ export interface OrganizationConnectionInformation {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/** Controls whether organizations using this template can be deleted. */
-export declare const OrganizationDeletionBehaviorEnum: {
-    readonly Allow: "allow";
-    readonly AllowIfEmpty: "allow_if_empty";
-};
-export type OrganizationDeletionBehaviorEnum = (typeof OrganizationDeletionBehaviorEnum)[keyof typeof OrganizationDeletionBehaviorEnum];
 export interface OrganizationDiscoveryDomain {
     /** Organization discovery domain identifier. */
     id: string;
@@ -30415,79 +30710,6 @@ export declare const OrganizationSortFieldEnum: {
     readonly CreatedAt: "created_at";
 };
 export type OrganizationSortFieldEnum = (typeof OrganizationSortFieldEnum)[keyof typeof OrganizationSortFieldEnum];
-export interface OrganizationTemplate {
-    /** Organization Template identifier. */
-    id?: string | undefined;
-    /** The name of the organization template. */
-    name?: string | undefined;
-    /** Whether this is the default template applied to new organizations. */
-    is_default?: boolean | undefined;
-    organization_deletion_behavior?: Management.OrganizationDeletionBehaviorEnum | undefined;
-    connection_deletion_behavior?: Management.ConnectionDeletionBehaviorEnum | undefined;
-    /** Whether to enforce permission ceiling for organizations using this template. */
-    enforce_permission_ceiling?: boolean | undefined;
-    /** Whether to enforce self-assignment restrictions for organizations using this template. */
-    enforce_self_assignment_restriction?: boolean | undefined;
-    /** The connection profile to apply to new connections. */
-    connection_profile_id?: string | undefined;
-    /** The user attribute profile to apply to organizations. */
-    user_attribute_profile_id?: string | undefined;
-    /** List of allowed connection strategies for this template. */
-    allowed_strategies?: Management.OrganizationTemplateAllowedStrategyEnum[] | undefined;
-    /** The client ID for the invitation landing page. */
-    invitation_landing_client_id?: string | undefined;
-    /** Default admin roles to assign to organization creators. */
-    admin_roles_assignment?: string[] | undefined;
-    use_for_organization_discovery?: (Management.OrganizationTemplateUseForOrganizationDiscovery | null) | undefined;
-    role_visibility_policy?: (Management.OrganizationTemplateRoleVisibilityPolicy | null) | undefined;
-    /** The ISO 8601 formatted timestamp representing when the template was created. */
-    created_at?: string | undefined;
-    /** The ISO 8601 formatted timestamp representing when the template was last updated. */
-    updated_at?: string | undefined;
-}
-/** An allowed enterprise connection strategy. */
-export declare const OrganizationTemplateAllowedStrategyEnum: {
-    readonly Adfs: "adfs";
-    readonly GoogleApps: "google-apps";
-    readonly Oidc: "oidc";
-    readonly Okta: "okta";
-    readonly Pingfederate: "pingfederate";
-    readonly Samlp: "samlp";
-    readonly Waad: "waad";
-};
-export type OrganizationTemplateAllowedStrategyEnum = (typeof OrganizationTemplateAllowedStrategyEnum)[keyof typeof OrganizationTemplateAllowedStrategyEnum];
-/** The role visibility level. */
-export declare const OrganizationTemplateRoleVisibilityEnum: {
-    readonly Write: "write";
-    readonly ReadOnly: "read_only";
-    readonly Hidden: "hidden";
-};
-export type OrganizationTemplateRoleVisibilityEnum = (typeof OrganizationTemplateRoleVisibilityEnum)[keyof typeof OrganizationTemplateRoleVisibilityEnum];
-/**
- * A role visibility override.
- */
-export interface OrganizationTemplateRoleVisibilityOverride {
-    /** The role identifier. */
-    role_id: string;
-    access: Management.OrganizationTemplateRoleVisibilityEnum;
-}
-/**
- * Controls role visibility for organization administrators.
- */
-export interface OrganizationTemplateRoleVisibilityPolicy {
-    default_value: Management.OrganizationTemplateRoleVisibilityEnum;
-    /** Role-specific visibility overrides. */
-    overrides?: Management.OrganizationTemplateRoleVisibilityOverride[] | undefined;
-}
-/**
- * Controls whether connections from this template are used for organization discovery.
- */
-export interface OrganizationTemplateUseForOrganizationDiscovery {
-    /** The default value for organization discovery. */
-    default_value: boolean;
-    /** The allowed values for organization discovery. */
-    allowed_values?: boolean[] | undefined;
-}
 /** Controls whether this organization can be used in user flows with third-party clients. Defaults to `block`. */
 export declare const OrganizationThirdPartyClientAccessEnum: {
     readonly Block: "block";
@@ -31109,6 +31331,8 @@ export interface ResourceServer {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -31208,6 +31432,8 @@ export interface ResourceServerSearchResponse {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -31758,6 +31984,79 @@ export interface SearchResourceServersResponseContent {
     /** Cursor for retrieving the next page of results. Omitted if there are no more results. */
     next?: string | undefined;
 }
+export interface Segment {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
+export interface SegmentContainsExpression {
+    contains: string[];
+}
+export interface SegmentEndsWithExpression {
+    ends_with: string[];
+}
+export interface SegmentExistsExpression {
+    exists: boolean;
+}
+/**
+ * Attribute conditions that must match.
+ */
+export interface SegmentMatchConditions {
+    client_id?: Management.SegmentMatchExpression | undefined;
+    connection?: Management.SegmentMatchExpression | undefined;
+    connection_type?: Management.SegmentMatchExpression | undefined;
+    organization_id?: Management.SegmentMatchExpression | undefined;
+    domain?: Management.SegmentMatchExpression | undefined;
+    device_type?: Management.SegmentMatchExpression | undefined;
+    browser?: Management.SegmentMatchExpression | undefined;
+    platform?: Management.SegmentMatchExpression | undefined;
+    user_agent?: Management.SegmentMatchExpression | undefined;
+    country?: Management.SegmentMatchExpression | undefined;
+    region?: Management.SegmentMatchExpression | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+export type SegmentMatchExpression = string[] | Management.SegmentContainsExpression | Management.SegmentStartsWithExpression | Management.SegmentEndsWithExpression | Management.SegmentExistsExpression;
+/**
+ * Attribute conditions that must not match.
+ */
+export interface SegmentNotMatchConditions {
+    client_id?: Management.SegmentMatchExpression | undefined;
+    connection?: Management.SegmentMatchExpression | undefined;
+    connection_type?: Management.SegmentMatchExpression | undefined;
+    organization_id?: Management.SegmentMatchExpression | undefined;
+    domain?: Management.SegmentMatchExpression | undefined;
+    device_type?: Management.SegmentMatchExpression | undefined;
+    browser?: Management.SegmentMatchExpression | undefined;
+    platform?: Management.SegmentMatchExpression | undefined;
+    user_agent?: Management.SegmentMatchExpression | undefined;
+    country?: Management.SegmentMatchExpression | undefined;
+    region?: Management.SegmentMatchExpression | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+export interface SegmentRule {
+    match?: Management.SegmentMatchConditions | undefined;
+    not_match?: Management.SegmentNotMatchConditions | undefined;
+}
+export interface SegmentStartsWithExpression {
+    starts_with: string[];
+}
+export declare const SegmentTypeEnum: {
+    readonly Self: "self";
+    readonly Auth0: "auth0";
+};
+export type SegmentTypeEnum = (typeof SegmentTypeEnum)[keyof typeof SegmentTypeEnum];
+/** Filter by type. Exact match. */
+export declare const SegmentTypeFilterEnum: {
+    readonly Auth0: "auth0";
+    readonly Self: "self";
+};
+export type SegmentTypeFilterEnum = (typeof SegmentTypeFilterEnum)[keyof typeof SegmentTypeFilterEnum];
 export interface SelfServiceProfile {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -33235,6 +33534,8 @@ export interface UpdateConnectionOptions {
     useOauthSpecScope?: Management.ConnectionUseOauthSpecScope | undefined;
     discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined;
     oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined;
+    thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -33742,6 +34043,78 @@ export interface UpdateEnabledClientConnectionsRequestContentItem {
 }
 export type UpdateEnabledClientConnectionsRequestContent = Management.UpdateEnabledClientConnectionsRequestContentItem[];
 export type UpdateEventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
+export interface UpdateExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface UpdateExperimentStatusResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Configuration parameters for this feature flag
+ */
+export type UpdateFeatureFlagParameters = Record<string, Management.FeatureFlagConfigParam>;
+export interface UpdateFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface UpdateFeatureFlagStatusResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateFlowResponseContent {
     id: string;
     name: string;
@@ -33989,6 +34362,8 @@ export interface UpdateResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -34047,6 +34422,15 @@ export interface UpdateScimConfigurationResponseContent {
     /** The ISO 8601 date and time the SCIM configuration was last updated on */
     updated_on: string;
 }
+export interface UpdateSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -34270,6 +34654,19 @@ export interface UpdateUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Configuration overrides for this variation; keys must exist in the parent flag parameters. Empty {} is the baseline (control) variation that overrides nothing.
+ */
+export type UpdateVariationOverridesMap = Record<string, unknown>;
+export interface UpdateVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -34813,6 +35210,25 @@ export interface UsersEnrollment {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface ValidateExperimentResponseContent {
+    /** Whether the experiment is ready to be activated. */
+    is_valid: boolean;
+    /** List of validation errors preventing activation. Empty when is_valid is true. */
+    errors: Management.ExperimentValidationError[];
+}
+export interface Variation {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Configuration overrides for this variation
+ */
+export type VariationOverridesMap = Record<string, unknown>;
 export interface VerifiableCredentialTemplateResponse {
     /** The id of the template. */
     id?: string | undefined;