auth0 7.2.0 → 7.4.0-beta.1

package/dist/cjs/management/api/types/types.d.ts

@@ -252,9 +252,18 @@ export declare const OauthScope: {
     /**
      * Read Events */
     readonly ReadEvents: "read:events";
+    /**
+     * Create Experimentation */
+    readonly CreateExperimentation: "create:experimentation";
+    /**
+     * Read Experimentation */
+    readonly ReadExperimentation: "read:experimentation";
     /**
      * Update Experimentation */
     readonly UpdateExperimentation: "update:experimentation";
+    /**
+     * Delete Experimentation */
+    readonly DeleteExperimentation: "delete:experimentation";
     /**
      * Create Flows */
     readonly CreateFlows: "create:flows";
@@ -735,9 +744,6 @@ export declare const OauthScope: {
     /**
      * Delete Organization Client Associations */
     readonly DeleteOrganizationClients: "delete:organization_clients";
-    /**
-     * Read Organization Templates */
-    readonly ReadOrganizationTemplates: "read:organization_templates";
     /**
      * Create Network ACL Keys */
     readonly CreateNetworkAclKeys: "create:network_acl_keys";
@@ -1323,6 +1329,37 @@ export interface AgentResponseContent {
     external_agent_id?: string | undefined;
     metadata: Management.AgentMetadata;
 }
+export interface AllocationItem {
+    variation_id?: string | undefined;
+    variation_name?: string | undefined;
+    segment_id?: string | undefined;
+    segment_name?: string | undefined;
+    weight?: number | undefined;
+    priority?: number | undefined;
+    is_control?: boolean | undefined;
+    is_fallback?: boolean | undefined;
+    variation_snapshot?: (Record<string, unknown> | null) | undefined;
+    segment_snapshot?: (Record<string, unknown> | null) | undefined;
+}
+export interface AllocationRequestItem {
+    /** The ID of the variation to allocate */
+    variation_id: string;
+    /** Percentage weight for this allocation (percentage strategy only) */
+    weight?: number | undefined;
+    /** The segment this allocation targets (segment strategy only) */
+    segment_id?: string | undefined;
+    /** Evaluation order; 1 = highest priority (segment strategy only) */
+    priority?: number | undefined;
+    /** Whether this allocation is the control group */
+    is_control: boolean;
+    /** Whether this allocation is the default fallback (segment strategy only) */
+    is_fallback?: boolean | undefined;
+}
+export declare const AllocationStrategyEnum: {
+    readonly Percentage: "percentage";
+    readonly Segment: "segment";
+};
+export type AllocationStrategyEnum = (typeof AllocationStrategyEnum)[keyof typeof AllocationStrategyEnum];
 /**
  * IP address to check.
  */
@@ -1359,6 +1396,7 @@ export interface AssociateOrganizationClientGrantResponseContent {
 export declare const AsyncApprovalNotificationsChannelsEnum: {
     readonly GuardianPush: "guardian-push";
     readonly Email: "email";
+    readonly MyAccount: "my-account";
 };
 export type AsyncApprovalNotificationsChannelsEnum = (typeof AsyncApprovalNotificationsChannelsEnum)[keyof typeof AsyncApprovalNotificationsChannelsEnum];
 export interface AttackProtectionCaptchaArkoseResponseContent {
@@ -1459,6 +1497,16 @@ export interface AttackProtectionUpdateCaptchaRecaptchaV2 {
     /** The secret key for the reCAPTCHA v2 provider. */
     secret: string;
 }
+/** Specifies the target authentication flow for this experiment. Must be one of: authentication, mfa_enrollment, mfa_challenge, password_reset, passkey_enrollment, or all. Note that the all value targets every flow at once, but requires that this is the only active experiment. */
+export declare const AuthenticationFlowEnum: {
+    readonly Authentication: "authentication";
+    readonly MfaEnrollment: "mfa_enrollment";
+    readonly MfaChallenge: "mfa_challenge";
+    readonly PasswordReset: "password_reset";
+    readonly PasskeyEnrollment: "passkey_enrollment";
+    readonly All: "all";
+};
+export type AuthenticationFlowEnum = (typeof AuthenticationFlowEnum)[keyof typeof AuthenticationFlowEnum];
 export declare const AuthenticationMethodTypeEnum: {
     readonly RecoveryCode: "recovery-code";
     readonly Totp: "totp";
@@ -1872,6 +1920,12 @@ export interface BreachedPasswordDetectionStage {
     "pre-user-registration"?: Management.BreachedPasswordDetectionPreUserRegistrationStage | undefined;
     "pre-change-password"?: Management.BreachedPasswordDetectionPreChangePasswordStage | undefined;
 }
+/** Controls whether the BFP unblock form is submitted automatically or requires manual interaction. Canonical field; deprecated alias normalized upstream. */
+export declare const BruteForceProtectionFormSubmissionModeEnum: {
+    readonly Manual: "manual";
+    readonly Auto: "auto";
+};
+export type BruteForceProtectionFormSubmissionModeEnum = (typeof BruteForceProtectionFormSubmissionModeEnum)[keyof typeof BruteForceProtectionFormSubmissionModeEnum];
 /**
  * Account Lockout: Determines whether or not IP address is used when counting failed attempts.
  *           Possible values: <code>count_per_identifier_and_ip</code>, <code>count_per_identifier</code>.
@@ -2501,11 +2555,11 @@ export declare const ClientAppTypeEnum: {
 };
 export type ClientAppTypeEnum = (typeof ClientAppTypeEnum)[keyof typeof ClientAppTypeEnum];
 /**
- * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
+ * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`, `my-account`.
  */
 export type ClientAsyncApprovalNotificationsChannelsApiPatchConfiguration = (Management.AsyncApprovalNotificationsChannelsEnum[] | null) | undefined;
 /**
- * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`.
+ * Array of notification channels for contacting the user when their approval is required. Valid values are `guardian-push`, `email`, `my-account`.
  */
 export type ClientAsyncApprovalNotificationsChannelsApiPostConfiguration = Management.AsyncApprovalNotificationsChannelsEnum[];
 /**
@@ -2873,6 +2927,7 @@ export declare const ClientOidcBackchannelLogoutInitiatorsEnum: {
     readonly EmailIdentifierChanged: "email-identifier-changed";
     readonly MfaPhoneUnenrolled: "mfa-phone-unenrolled";
     readonly AccountDeactivated: "account-deactivated";
+    readonly ProfileChanged: "profile-changed";
 };
 export type ClientOidcBackchannelLogoutInitiatorsEnum = (typeof ClientOidcBackchannelLogoutInitiatorsEnum)[keyof typeof ClientOidcBackchannelLogoutInitiatorsEnum];
 /** The `mode` property determines the configuration method for enabling initiators. `custom` enables only the initiators listed in the selected_initiators array, `all` enables all current and future initiators. */
@@ -2901,6 +2956,29 @@ export interface ClientOidcBackchannelLogoutSettings {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export declare const ClientOidcSupportAllowedScopesEnum: {
+    readonly Profile: "profile";
+    readonly Email: "email";
+    readonly Address: "address";
+    readonly Phone: "phone";
+};
+export type ClientOidcSupportAllowedScopesEnum = (typeof ClientOidcSupportAllowedScopesEnum)[keyof typeof ClientOidcSupportAllowedScopesEnum];
+/**
+ * OIDC support configuration for a client. Replaces the stored object entirely; send null to unset it.
+ */
+export interface ClientOidcSupportPatch {
+    is_allowed: boolean;
+    allow_all_scopes?: boolean | undefined;
+    allowed_scopes?: Management.ClientOidcSupportAllowedScopesEnum[] | undefined;
+}
+/**
+ * OIDC support configuration for a client. Controls whether OIDC flows are allowed and which scopes the client may request.
+ */
+export interface ClientOidcSupportPost {
+    is_allowed: boolean;
+    allow_all_scopes?: boolean | undefined;
+    allowed_scopes?: Management.ClientOidcSupportAllowedScopesEnum[] | undefined;
+}
 /** Method for discovering organizations during the `pre_login_prompt`. `email` allows users to find their organization by entering their email address and performing domain matching, while `organization_name` requires users to enter the organization name directly. These methods can be combined. */
 export declare const ClientOrganizationDiscoveryEnum: {
     readonly Email: "email";
@@ -2966,6 +3044,113 @@ export interface ClientRefreshTokenPolicy {
     /** The resource server permissions granted under the Multi Resource Refresh Token Policy, defining the context in which an access token can be used */
     scope: string[];
 }
+export interface ClientSearchResponse {
+    /** ID of this client. */
+    client_id?: string | undefined;
+    /** The ISO 8601 timestamp of when this client was created. */
+    created_at?: string | undefined;
+    /** The ISO 8601 timestamp of when this client was last updated. */
+    updated_at?: string | undefined;
+    /** Name of the tenant this client belongs to. */
+    tenant?: string | undefined;
+    /** Name of this client (min length: 1 character, does not allow `<` or `>`). */
+    name?: string | undefined;
+    /** Free text description of this client (max length: 140 characters). */
+    description?: string | undefined;
+    /** Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false). */
+    global?: boolean | undefined;
+    app_type?: Management.ClientAppTypeEnum | undefined;
+    /** URL of the logo to display for this client. Recommended size is 150x150 pixels. */
+    logo_uri?: string | undefined;
+    /** Whether this client a first party client (true) or not (false). */
+    is_first_party?: boolean | undefined;
+    /** Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false). */
+    oidc_conformant?: boolean | undefined;
+    /** Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication. */
+    callbacks?: string[] | undefined;
+    /** Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs. */
+    allowed_origins?: string[] | undefined;
+    /** Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>. */
+    web_origins?: string[] | undefined;
+    /** List of audiences/realms for SAML protocol. Used by the wsfed addon. */
+    client_aliases?: string[] | undefined;
+    /** List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed. */
+    allowed_clients?: string[] | undefined;
+    /** Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains. */
+    allowed_logout_urls?: string[] | undefined;
+    session_transfer?: (Management.ClientSessionTransferConfiguration | null) | undefined;
+    oidc_logout?: Management.ClientOidcBackchannelLogoutSettings | undefined;
+    /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
+    grant_types?: string[] | undefined;
+    jwt_configuration?: Management.ClientJwtConfiguration | undefined;
+    /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
+    sso?: boolean | undefined;
+    /** Whether Single Sign On is disabled (true) or enabled (true). Defaults to true. */
+    sso_disabled?: boolean | undefined;
+    /** Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false). */
+    cross_origin_authentication?: boolean | undefined;
+    /** URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page. */
+    cross_origin_loc?: string | undefined;
+    /** Whether a custom login page is to be used (true) or the default provided login page (false). */
+    custom_login_page_on?: boolean | undefined;
+    /** The content (HTML, CSS, JS) of the custom login page. */
+    custom_login_page?: string | undefined;
+    /** The content (HTML, CSS, JS) of the custom login page. (Used on Previews) */
+    custom_login_page_preview?: string | undefined;
+    /** HTML form template to be used for WS-Federation. */
+    form_template?: string | undefined;
+    token_endpoint_auth_method?: Management.ClientTokenEndpointAuthMethodEnum | undefined;
+    /** If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint. */
+    is_token_endpoint_ip_header_trusted?: boolean | undefined;
+    client_metadata?: Management.ClientMetadata | undefined;
+    mobile?: Management.ClientMobile | undefined;
+    /** Initiate login uri, must be https */
+    initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
+    refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
+    default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
+    organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
+    organization_require_behavior?: Management.ClientOrganizationRequireBehaviorEnum | undefined;
+    /** Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both. */
+    organization_discovery_methods?: Management.ClientOrganizationDiscoveryEnum[] | undefined;
+    client_authentication_methods?: (Management.ClientAuthenticationMethod | null) | undefined;
+    /** Makes the use of Pushed Authorization Requests mandatory for this client */
+    require_pushed_authorization_requests?: boolean | undefined;
+    /** Makes the use of Proof-of-Possession mandatory for this client */
+    require_proof_of_possession?: boolean | undefined;
+    signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
+    compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
+    /**
+     * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
+     * If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
+     * See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.
+     */
+    skip_non_verifiable_callback_uri_confirmation_prompt?: boolean | undefined;
+    token_exchange?: Management.ClientTokenExchangeConfiguration | undefined;
+    /** Specifies how long, in seconds, a Pushed Authorization Request URI remains valid */
+    par_request_expiry?: (number | null) | undefined;
+    token_quota?: Management.TokenQuota | undefined;
+    express_configuration?: Management.ExpressConfiguration | undefined;
+    b2b_integration_configuration?: Management.B2BIntegrationConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    identity_assertion_authorization_grant?: Management.IdentityAssertionAuthorizationGrant | undefined;
+    anonymous_sessions?: Management.AnonymousSessions | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
+    /** The identifier of the resource server that this client is linked to. */
+    resource_server_identifier?: string | undefined;
+    async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export declare const ClientSessionTransferAllowedAuthenticationMethodsEnum: {
     readonly Cookie: "cookie";
     readonly Query: "query";
@@ -3038,6 +3223,12 @@ export interface ClientSigningKey {
  * Signing certificates associated with this client.
  */
 export type ClientSigningKeys = (Management.ClientSigningKey[] | null) | undefined;
+/** Field name to sort results by in ascending order. Defaults to insertion order (oldest first) if not provided. */
+export declare const ClientSortFieldEnum: {
+    readonly Name: "name";
+    readonly UpdatedAt: "updated_at";
+};
+export type ClientSortFieldEnum = (typeof ClientSortFieldEnum)[keyof typeof ClientSortFieldEnum];
 /** Security mode for third-party clients. `strict` enforces <a href="https://auth0.com/docs/get-started/applications/third-party-applications/security-controls">enhanced security controls</a>: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. `permissive` preserves <a href="https://auth0.com/docs/get-started/applications/third-party-applications/permissive-mode">pre-existing behavior</a> and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified. */
 export declare const ClientThirdPartySecurityModeEnum: {
     readonly Strict: "strict";
@@ -3521,12 +3712,6 @@ export type ConnectionDecryptionKeySaml =
 /**
  * Private key in PEM format. */
  | string;
-/** Controls whether connections created from this template can be deleted. */
-export declare const ConnectionDeletionBehaviorEnum: {
-    readonly Allow: "allow";
-    readonly AllowIfEmpty: "allow_if_empty";
-};
-export type ConnectionDeletionBehaviorEnum = (typeof ConnectionDeletionBehaviorEnum)[keyof typeof ConnectionDeletionBehaviorEnum];
 /**
  * The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.
  */
@@ -4146,6 +4331,7 @@ export interface ConnectionOptionsAd extends Management.ConnectionOptionsCommon
     signInEndpoint?: Management.ConnectionSignInEndpointAd | undefined;
     tenant_domain?: Management.ConnectionTenantDomainAd | undefined;
     thumbprints?: Management.ConnectionThumbprintsAd | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384Ad | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -4167,6 +4353,7 @@ export interface ConnectionOptionsAdfs extends Management.ConnectionOptionsCommo
     signInEndpoint?: Management.ConnectionSignInEndpointAdfs | undefined;
     tenant_domain?: Management.ConnectionTenantDomain | undefined;
     thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */
     user_id_attribute?: string | undefined;
@@ -4360,6 +4547,7 @@ export interface ConnectionOptionsAzureAd extends Management.ConnectionOptionsCo
     tenant_domain?: Management.ConnectionTenantDomainAzureAdOne | undefined;
     tenantId?: Management.ConnectionTenantIdAzureAd | undefined;
     thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
     /** Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect. */
     use_wsfed?: boolean | undefined;
@@ -4476,6 +4664,7 @@ export interface ConnectionOptionsCommonSaml {
     signatureAlgorithm?: Management.ConnectionSignatureAlgorithmSaml | undefined;
     tenant_domain?: Management.ConnectionTenantDomainSaml | undefined;
     thumbprints?: Management.ConnectionThumbprintsSaml | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384Saml | undefined;
     upstream_params?: ((Management.ConnectionUpstreamParams | undefined) | null) | undefined;
 }
 /**
@@ -5801,6 +5990,8 @@ export interface ConnectionPropertiesOptions {
     useOauthSpecScope?: Management.ConnectionUseOauthSpecScope | undefined;
     discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined;
     oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined;
+    thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -6930,7 +7121,7 @@ export type ConnectionTenantDomainSaml = string;
  */
 export type ConnectionTenantIdAzureAd = string;
 /**
- * Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.
+ * Array of certificate thumbprints (SHA-128 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.
  */
 export type ConnectionThumbprints = string[];
 /**
@@ -6941,6 +7132,18 @@ export type ConnectionThumbprintsAd = Management.ConnectionSha1Thumbprint[];
  * SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.
  */
 export type ConnectionThumbprintsSaml = Management.ConnectionSha1Thumbprint[];
+/**
+ * Array of certificate thumbprints (SHA-384 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a 96-character hexadecimal string.
+ */
+export type ConnectionThumbprintsSha384 = string[];
+/**
+ * Array of certificate SHA-384 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.
+ */
+export type ConnectionThumbprintsSha384Ad = string[];
+/**
+ * SHA-384 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 96-character hexadecimal string.
+ */
+export type ConnectionThumbprintsSha384Saml = string[];
 /**
  * URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.
  */
@@ -8427,6 +8630,30 @@ export interface CreateEventStreamWebHookRequestContent {
     destination: Management.EventStreamWebhookDestination;
     status?: Management.EventStreamStatusEnum | undefined;
 }
+export interface CreateExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateExportUsersFields {
     /** Name of the field in the profile. */
     name: string;
@@ -8452,6 +8679,20 @@ export interface CreateExportUsersResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Configuration parameters for this feature flag
+ */
+export type CreateFeatureFlagParameters = Record<string, Management.FeatureFlagConfigParam>;
+export interface CreateFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateFlowResponseContent {
     id: string;
     name: string;
@@ -9117,6 +9358,8 @@ export interface CreateResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -9185,6 +9428,15 @@ export interface CreateScimTokenResponseContent {
     /** The token's valid until at timestamp */
     valid_until?: string | undefined;
 }
+export interface CreateSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -9322,6 +9574,15 @@ export interface CreateUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface CreateVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface CreateVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -9624,6 +9885,12 @@ export interface DailyStats {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** For Auth0-managed flags, where non-overridden config keys resolve from: 'tenant' inherits the tenant's live config, 'flag' uses the flag's frozen defaults. Omitted when unset (defaults to 'tenant' at resolution). Not applicable to customer-defined flags. */
+export declare const DefaultConfigEnum: {
+    readonly Tenant: "tenant";
+    readonly Flag: "flag";
+};
+export type DefaultConfigEnum = (typeof DefaultConfigEnum)[keyof typeof DefaultConfigEnum];
 /** Default authentication method for email identifier */
 export declare const DefaultMethodEmailIdentifierEnum: {
     readonly Password: "password";
@@ -24173,6 +24440,53 @@ export interface EventStreamWebhookResponseContent {
     /** Timestamp when the event stream was last updated. */
     updated_at?: string | undefined;
 }
+export interface ExperimentListItem {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+/** Filter by status. Exact match. */
+export declare const ExperimentStatusEnum: {
+    readonly Draft: "draft";
+    readonly Active: "active";
+    readonly Paused: "paused";
+    readonly Completed: "completed";
+    readonly Archived: "archived";
+};
+export type ExperimentStatusEnum = (typeof ExperimentStatusEnum)[keyof typeof ExperimentStatusEnum];
+/** The target status to transition the experiment to. */
+export declare const ExperimentTransitionStatusEnum: {
+    readonly Active: "active";
+    readonly Paused: "paused";
+    readonly Completed: "completed";
+    readonly Archived: "archived";
+};
+export type ExperimentTransitionStatusEnum = (typeof ExperimentTransitionStatusEnum)[keyof typeof ExperimentTransitionStatusEnum];
+export interface ExperimentValidationError {
+    /** Machine-readable error code identifying the validation failure. */
+    code: string;
+    /** Human-readable description of the validation failure. */
+    message: string;
+}
 /**
  * Application specific configuration for use with the OIN Express Configuration feature.
  */
@@ -24221,6 +24535,48 @@ export interface ExpressConfigurationOrNull {
 }
 export interface ExtensibilityEmailProviderCredentials {
 }
+export interface FeatureFlag {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface FeatureFlagConfigParam {
+    type: Management.FeatureFlagConfigParamTypeEnum;
+    value?: unknown | undefined;
+    /** A human-readable description of the parameter */
+    description?: string | undefined;
+}
+/** The data type of the parameter value */
+export declare const FeatureFlagConfigParamTypeEnum: {
+    readonly String: "string";
+    readonly Boolean: "boolean";
+    readonly Number: "number";
+    readonly Array: "array";
+    readonly Object: "object";
+};
+export type FeatureFlagConfigParamTypeEnum = (typeof FeatureFlagConfigParamTypeEnum)[keyof typeof FeatureFlagConfigParamTypeEnum];
+/**
+ * Configuration parameters for this feature flag
+ */
+export type FeatureFlagConfigParams = Record<string, Management.FeatureFlagConfigParam>;
+/** Filter by status. Exact match. */
+export declare const FeatureFlagStatusEnum: {
+    readonly Draft: "draft";
+    readonly Active: "active";
+    readonly Archived: "archived";
+};
+export type FeatureFlagStatusEnum = (typeof FeatureFlagStatusEnum)[keyof typeof FeatureFlagStatusEnum];
+/** Filter by type. Exact match. */
+export declare const FeatureFlagTypeEnum: {
+    readonly Auth0: "auth0";
+    readonly Self: "self";
+};
+export type FeatureFlagTypeEnum = (typeof FeatureFlagTypeEnum)[keyof typeof FeatureFlagTypeEnum];
 /**
  * Configure FedCM login settings for New Universal Login
  */
@@ -27295,6 +27651,7 @@ export interface GetBruteForceSettingsResponseContent {
     mode?: Management.BruteForceProtectionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface GetClientCredentialResponseContent {
     /** ID of the credential. Generated on creation. */
@@ -27657,6 +28014,40 @@ export interface GetEventStreamDeliveryHistoryResponseContent {
     event?: Management.EventStreamCloudEvent | undefined;
 }
 export type GetEventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
+export interface GetExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface GetFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export declare const GetFlowExecutionRequestParametersHydrateEnum: {
     readonly Debug: "debug";
 };
@@ -28206,6 +28597,8 @@ export interface GetResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -28272,6 +28665,15 @@ export interface GetScimConfigurationResponseContent {
  * The list of scim tokens for scim clients
  */
 export type GetScimTokensResponseContent = Management.ScimTokenItem[];
+export interface GetSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface GetSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -28571,6 +28973,15 @@ export interface GetUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface GetVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface GetVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -29110,6 +29521,16 @@ export interface ListEventStreamsResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface ListExperimentsResponseContent {
+    experiments: Management.ExperimentListItem[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
+export interface ListFeatureFlagsResponseContent {
+    feature_flags: Management.FeatureFlag[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
 export interface ListFlowExecutionsPaginatedResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: string | undefined;
@@ -29307,6 +29728,11 @@ export interface ListScimConfigurationsResponseContent {
     /** The cursor to be used as the "from" query parameter for the next page of results. */
     next?: string | undefined;
 }
+export interface ListSegmentsResponseContent {
+    segments: Management.Segment[];
+    /** Checkpoint token for the next page. Omitted when there are no further results. */
+    next?: string | undefined;
+}
 /**
  * The list of custom text keys and values.
  */
@@ -29419,6 +29845,9 @@ export interface ListUsersOffsetPaginatedResponseContent {
     total?: number | undefined;
     users?: Management.UserResponseSchema[] | undefined;
 }
+export interface ListVariationsResponseContent {
+    variations: Management.Variation[];
+}
 export interface ListVerifiableCredentialTemplatesPaginatedResponseContent {
     /** Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours. */
     next?: (string | null) | undefined;
@@ -30286,12 +30715,6 @@ export interface OrganizationConnectionInformation {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/** Controls whether organizations using this template can be deleted. */
-export declare const OrganizationDeletionBehaviorEnum: {
-    readonly Allow: "allow";
-    readonly AllowIfEmpty: "allow_if_empty";
-};
-export type OrganizationDeletionBehaviorEnum = (typeof OrganizationDeletionBehaviorEnum)[keyof typeof OrganizationDeletionBehaviorEnum];
 export interface OrganizationDiscoveryDomain {
     /** Organization discovery domain identifier. */
     id: string;
@@ -30415,79 +30838,6 @@ export declare const OrganizationSortFieldEnum: {
     readonly CreatedAt: "created_at";
 };
 export type OrganizationSortFieldEnum = (typeof OrganizationSortFieldEnum)[keyof typeof OrganizationSortFieldEnum];
-export interface OrganizationTemplate {
-    /** Organization Template identifier. */
-    id?: string | undefined;
-    /** The name of the organization template. */
-    name?: string | undefined;
-    /** Whether this is the default template applied to new organizations. */
-    is_default?: boolean | undefined;
-    organization_deletion_behavior?: Management.OrganizationDeletionBehaviorEnum | undefined;
-    connection_deletion_behavior?: Management.ConnectionDeletionBehaviorEnum | undefined;
-    /** Whether to enforce permission ceiling for organizations using this template. */
-    enforce_permission_ceiling?: boolean | undefined;
-    /** Whether to enforce self-assignment restrictions for organizations using this template. */
-    enforce_self_assignment_restriction?: boolean | undefined;
-    /** The connection profile to apply to new connections. */
-    connection_profile_id?: string | undefined;
-    /** The user attribute profile to apply to organizations. */
-    user_attribute_profile_id?: string | undefined;
-    /** List of allowed connection strategies for this template. */
-    allowed_strategies?: Management.OrganizationTemplateAllowedStrategyEnum[] | undefined;
-    /** The client ID for the invitation landing page. */
-    invitation_landing_client_id?: string | undefined;
-    /** Default admin roles to assign to organization creators. */
-    admin_roles_assignment?: string[] | undefined;
-    use_for_organization_discovery?: (Management.OrganizationTemplateUseForOrganizationDiscovery | null) | undefined;
-    role_visibility_policy?: (Management.OrganizationTemplateRoleVisibilityPolicy | null) | undefined;
-    /** The ISO 8601 formatted timestamp representing when the template was created. */
-    created_at?: string | undefined;
-    /** The ISO 8601 formatted timestamp representing when the template was last updated. */
-    updated_at?: string | undefined;
-}
-/** An allowed enterprise connection strategy. */
-export declare const OrganizationTemplateAllowedStrategyEnum: {
-    readonly Adfs: "adfs";
-    readonly GoogleApps: "google-apps";
-    readonly Oidc: "oidc";
-    readonly Okta: "okta";
-    readonly Pingfederate: "pingfederate";
-    readonly Samlp: "samlp";
-    readonly Waad: "waad";
-};
-export type OrganizationTemplateAllowedStrategyEnum = (typeof OrganizationTemplateAllowedStrategyEnum)[keyof typeof OrganizationTemplateAllowedStrategyEnum];
-/** The role visibility level. */
-export declare const OrganizationTemplateRoleVisibilityEnum: {
-    readonly Write: "write";
-    readonly ReadOnly: "read_only";
-    readonly Hidden: "hidden";
-};
-export type OrganizationTemplateRoleVisibilityEnum = (typeof OrganizationTemplateRoleVisibilityEnum)[keyof typeof OrganizationTemplateRoleVisibilityEnum];
-/**
- * A role visibility override.
- */
-export interface OrganizationTemplateRoleVisibilityOverride {
-    /** The role identifier. */
-    role_id: string;
-    access: Management.OrganizationTemplateRoleVisibilityEnum;
-}
-/**
- * Controls role visibility for organization administrators.
- */
-export interface OrganizationTemplateRoleVisibilityPolicy {
-    default_value: Management.OrganizationTemplateRoleVisibilityEnum;
-    /** Role-specific visibility overrides. */
-    overrides?: Management.OrganizationTemplateRoleVisibilityOverride[] | undefined;
-}
-/**
- * Controls whether connections from this template are used for organization discovery.
- */
-export interface OrganizationTemplateUseForOrganizationDiscovery {
-    /** The default value for organization discovery. */
-    default_value: boolean;
-    /** The allowed values for organization discovery. */
-    allowed_values?: boolean[] | undefined;
-}
 /** Controls whether this organization can be used in user flows with third-party clients. Defaults to `block`. */
 export declare const OrganizationThirdPartyClientAccessEnum: {
     readonly Block: "block";
@@ -31109,6 +31459,8 @@ export interface ResourceServer {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -31208,6 +31560,8 @@ export interface ResourceServerSearchResponse {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -31718,6 +32072,12 @@ export declare const ScreenGroupNameEnum: {
     readonly AsyncApprovalWrongUser: "async-approval-wrong-user";
 };
 export type ScreenGroupNameEnum = (typeof ScreenGroupNameEnum)[keyof typeof ScreenGroupNameEnum];
+export interface SearchClientsResponseContent {
+    /** Array of client objects matching the search criteria. */
+    clients: Management.ClientSearchResponse[];
+    /** Cursor for retrieving the next page of results. Absent when no more results are available. */
+    next?: string | undefined;
+}
 /** The version of the search engine */
 export declare const SearchEngineVersionsEnum: {
     readonly V1: "v1";
@@ -31758,6 +32118,79 @@ export interface SearchResourceServersResponseContent {
     /** Cursor for retrieving the next page of results. Omitted if there are no more results. */
     next?: string | undefined;
 }
+export interface Segment {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
+export interface SegmentContainsExpression {
+    contains: string[];
+}
+export interface SegmentEndsWithExpression {
+    ends_with: string[];
+}
+export interface SegmentExistsExpression {
+    exists: boolean;
+}
+/**
+ * Attribute conditions that must match.
+ */
+export interface SegmentMatchConditions {
+    client_id?: Management.SegmentMatchExpression | undefined;
+    connection?: Management.SegmentMatchExpression | undefined;
+    connection_type?: Management.SegmentMatchExpression | undefined;
+    organization_id?: Management.SegmentMatchExpression | undefined;
+    domain?: Management.SegmentMatchExpression | undefined;
+    device_type?: Management.SegmentMatchExpression | undefined;
+    browser?: Management.SegmentMatchExpression | undefined;
+    platform?: Management.SegmentMatchExpression | undefined;
+    user_agent?: Management.SegmentMatchExpression | undefined;
+    country?: Management.SegmentMatchExpression | undefined;
+    region?: Management.SegmentMatchExpression | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+export type SegmentMatchExpression = string[] | Management.SegmentContainsExpression | Management.SegmentStartsWithExpression | Management.SegmentEndsWithExpression | Management.SegmentExistsExpression;
+/**
+ * Attribute conditions that must not match.
+ */
+export interface SegmentNotMatchConditions {
+    client_id?: Management.SegmentMatchExpression | undefined;
+    connection?: Management.SegmentMatchExpression | undefined;
+    connection_type?: Management.SegmentMatchExpression | undefined;
+    organization_id?: Management.SegmentMatchExpression | undefined;
+    domain?: Management.SegmentMatchExpression | undefined;
+    device_type?: Management.SegmentMatchExpression | undefined;
+    browser?: Management.SegmentMatchExpression | undefined;
+    platform?: Management.SegmentMatchExpression | undefined;
+    user_agent?: Management.SegmentMatchExpression | undefined;
+    country?: Management.SegmentMatchExpression | undefined;
+    region?: Management.SegmentMatchExpression | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
+export interface SegmentRule {
+    match?: Management.SegmentMatchConditions | undefined;
+    not_match?: Management.SegmentNotMatchConditions | undefined;
+}
+export interface SegmentStartsWithExpression {
+    starts_with: string[];
+}
+export declare const SegmentTypeEnum: {
+    readonly Self: "self";
+    readonly Auth0: "auth0";
+};
+export type SegmentTypeEnum = (typeof SegmentTypeEnum)[keyof typeof SegmentTypeEnum];
+/** Filter by type. Exact match. */
+export declare const SegmentTypeFilterEnum: {
+    readonly Auth0: "auth0";
+    readonly Self: "self";
+};
+export type SegmentTypeFilterEnum = (typeof SegmentTypeFilterEnum)[keyof typeof SegmentTypeFilterEnum];
 export interface SelfServiceProfile {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -33049,6 +33482,7 @@ export interface UpdateBruteForceSettingsResponseContent {
     mode?: Management.BruteForceProtectionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface UpdateClientGrantResponseContent {
     /** ID of the client grant. */
@@ -33235,6 +33669,8 @@ export interface UpdateConnectionOptions {
     useOauthSpecScope?: Management.ConnectionUseOauthSpecScope | undefined;
     discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined;
     oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined;
+    thumbprints?: Management.ConnectionThumbprints | undefined;
+    thumbprints_sha384?: Management.ConnectionThumbprintsSha384 | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
 }
@@ -33742,6 +34178,78 @@ export interface UpdateEnabledClientConnectionsRequestContentItem {
 }
 export type UpdateEnabledClientConnectionsRequestContent = Management.UpdateEnabledClientConnectionsRequestContentItem[];
 export type UpdateEventStreamResponseContent = Management.EventStreamWebhookResponseContent | Management.EventStreamEventBridgeResponseContent | Management.EventStreamActionResponseContent;
+export interface UpdateExperimentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface UpdateExperimentStatusResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    feature_flag_id: string;
+    feature_flag_name?: string | undefined;
+    authentication_flow: string;
+    allocation_strategy: Management.AllocationStrategyEnum;
+    status: Management.ExperimentStatusEnum;
+    is_valid: boolean;
+    default_config?: Management.DefaultConfigEnum | undefined;
+    feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
+    allocations: Management.AllocationItem[];
+    /** Fields that may be mutated given the experiment's current status. Computed at response time; always current with the API's enforcement logic. */
+    editable_fields: string[];
+    /** Ramp experiment levels configuration. */
+    levels?: number[] | undefined;
+    /** Read-only. The active exposure percentage for the current ramp step. Null when no ramp schedule is active. */
+    current_level?: (number | null) | undefined;
+    started_at?: string | undefined;
+    ended_at?: string | undefined;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Configuration parameters for this feature flag
+ */
+export type UpdateFeatureFlagParameters = Record<string, Management.FeatureFlagConfigParam>;
+export interface UpdateFeatureFlagResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
+export interface UpdateFeatureFlagStatusResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.FeatureFlagTypeEnum;
+    status: Management.FeatureFlagStatusEnum;
+    parameters?: Management.FeatureFlagConfigParams | undefined;
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateFlowResponseContent {
     id: string;
     name: string;
@@ -33989,6 +34497,8 @@ export interface UpdateResourceServerResponseContent {
     access_token?: (Management.ResourceServerAccessToken | null) | undefined;
     token_encryption?: (Management.ResourceServerTokenEncryption | null) | undefined;
     consent_policy?: (Management.ResourceServerConsentPolicyEnum | null) | undefined;
+    /** When true, the resource server requires every consent approval to be digitally signed, so the approver cannot later deny a consent they granted. When false, consent decisions do not need a signature. Defaults to false. A configured value is still returned even after the related entitlement is disabled. */
+    require_consent_non_repudiation?: boolean | undefined;
     authorization_details?: (unknown[] | null) | undefined;
     proof_of_possession?: (Management.ResourceServerProofOfPossession | null) | undefined;
     subject_type_authorization?: Management.ResourceServerSubjectTypeAuthorization | undefined;
@@ -34047,6 +34557,15 @@ export interface UpdateScimConfigurationResponseContent {
     /** The ISO 8601 date and time the SCIM configuration was last updated on */
     updated_on: string;
 }
+export interface UpdateSegmentResponseContent {
+    id: string;
+    name: string;
+    description?: string | undefined;
+    type: Management.SegmentTypeEnum;
+    rules: Management.SegmentRule[];
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateSelfServiceProfileResponseContent {
     /** The unique ID of the self-service Profile. */
     id?: string | undefined;
@@ -34270,6 +34789,19 @@ export interface UpdateUserResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * Configuration overrides for this variation; keys must exist in the parent flag parameters. Empty {} is the baseline (control) variation that overrides nothing.
+ */
+export type UpdateVariationOverridesMap = Record<string, unknown>;
+export interface UpdateVariationResponseContent {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
 export interface UpdateVerifiableCredentialTemplateResponseContent {
     /** The id of the template. */
     id?: string | undefined;
@@ -34813,6 +35345,25 @@ export interface UsersEnrollment {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface ValidateExperimentResponseContent {
+    /** Whether the experiment is ready to be activated. */
+    is_valid: boolean;
+    /** List of validation errors preventing activation. Empty when is_valid is true. */
+    errors: Management.ExperimentValidationError[];
+}
+export interface Variation {
+    id: string;
+    feature_flag_id: string;
+    name: string;
+    description?: string | undefined;
+    overrides: Management.VariationOverridesMap;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Configuration overrides for this variation
+ */
+export type VariationOverridesMap = Record<string, unknown>;
 export interface VerifiableCredentialTemplateResponse {
     /** The id of the template. */
     id?: string | undefined;