auth0 7.3.0 → 7.4.0-beta.1

package/README.md

@@ -34,6 +34,11 @@ Using [npm](https://npmjs.org) in your project directory run the following comma
 npm install auth0
 ```
 
+> [!NOTE]
+> **Release channels.** Endpoints move through three maturity tiers: Generally Available, Early Access, and Beta. This package is published on two channels. The stable channel (`npm install auth0`) includes the Generally Available and Early Access endpoints. The beta channel (`npm install auth0@beta`) is a superset that includes all three tiers.
+>
+> Beta prereleases can introduce breaking changes between versions, so pin an exact version if you need reproducible installs.
+
 ### Configure the SDK
 
 #### Authentication

package/dist/cjs/management/api/requests/requests.d.ts

@@ -369,6 +369,34 @@ export interface RegisterCimdClientRequestContent {
     /** URL to the Client ID Metadata Document. Acts as the unique identifier for upsert operations. */
     external_client_id: string;
 }
+/**
+ * @example
+ *     {
+ *         q: "q",
+ *         parser: "scim",
+ *         fields: "fields",
+ *         include_fields: true,
+ *         take: 1,
+ *         from: "from",
+ *         sort: "name"
+ *     }
+ */
+export interface SearchClientsRequestParameters {
+    /** Filter expression in SCIM or Lucene syntax (depending on parser parameter). SCIM examples: `name eq "Auth0"`, `name sw "auth" and app_type eq "spa"`. SCIM operators: eq, ne, sw, ew, co, pr, gt, ge, lt, le, and, or. <br /><br /><b>Supported Fields</b>:<br /><ul><li><i>client_id</i> - Auth0 client ID (case-sensitive, exact match)</li><li><i>external_client_id</i> - URL of the Client ID Metadata Document (CIMD); case-sensitive, exact match</li><li><i>name</i> - Client name (supports contains, starts-with, ends-with operators; sortable)</li><li><i>app_type</i> - Application type (e.g. "spa", "native", "non_interactive")</li><li><i>is_first_party</i> - Whether the client is first-party (boolean)</li><li><i>updated_at</i> - Last update timestamp (supports date range operators; sortable)</li><li><i>metadata.{key}</i> - Filter by client metadata key-value pairs (max 2-level key depth, values indexed up to 64 characters)</li><li><i>client_grant.organization_id</i> - Filter by associated organization ID</li><li><i>client_grant.allow_any_organization</i> - Filter by allow any organization setting</li></ul>Maximum 5 filter operations per query. Results are eventually consistent and may not reflect recent updates. */
+    q?: string | null;
+    /** Query parser to use for the filter expression. Use "scim" for SCIM filter syntax or "lucene" for Lucene query syntax (default). */
+    parser?: Management.SearchParserEnum | null;
+    /** Comma-separated list of fields to include or exclude in the response. Works with the include_fields parameter to control projection mode. Maximum 50 fields. */
+    fields?: string | null;
+    /** Controls field projection mode. Set to true to include only fields specified in the fields parameter. Set to false to exclude fields specified in the fields parameter. Defaults to true if not specified. */
+    include_fields?: boolean | null;
+    /** Maximum number of results to return per page (1-100). Defaults to 50. */
+    take?: number | null;
+    /** Cursor for the next page of results. Use the value from the next field in the previous response. */
+    from?: string | null;
+    /** Field name to sort results by in ascending order. Defaults to insertion order (oldest first) if not provided. */
+    sort?: Management.ClientSortFieldEnum | null;
+}
 /**
  * @example
  *     {
@@ -480,6 +508,7 @@ export interface UpdateClientRequestContent {
     async_approval_notification_channels?: (Management.ClientAsyncApprovalNotificationsChannelsApiPatchConfiguration | undefined) | null;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum;
     redirection_policy?: Management.ClientRedirectionPolicyEnum;
+    oidc_support?: Management.ClientOidcSupportPatch | null;
 }
 /**
  * @example
@@ -2256,6 +2285,7 @@ export interface UpdateBruteForceSettingsRequestContent {
     mode?: Management.BruteForceProtectionModeEnum;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum;
 }
 /**
  * @example

package/dist/cjs/management/api/resources/clients/client/Client.d.ts

@@ -151,6 +151,43 @@ export declare class ClientsClient {
      */
     registerCimdClient(request: Management.RegisterCimdClientRequestContent, requestOptions?: ClientsClient.RequestOptions): core.HttpResponsePromise<Management.RegisterCimdClientResponseContent>;
     private __registerCimdClient;
+    /**
+     * Search clients using SCIM or Lucene filter syntax with low-latency, eventually consistent results.
+     * Use the parser parameter to specify "scim" or "lucene" syntax (default: "lucene").
+     * This endpoint provides an alternative to the standard GET /clients endpoint with better performance
+     * for complex queries. Results may not reflect recent updates immediately.
+     *
+     * - This endpoint only supports `read:clients` and `read:client_summary` scopes. The `read:client_keys` and `read:client_credentials` scopes are not supported.
+     * - The following fields are never returned by this endpoint:
+     *   - `client_secret`
+     *   - `encryption_key`
+     *   - `signing_keys`
+     *   - `owners`
+     *   - `addons`
+     *
+     * @param {Management.SearchClientsRequestParameters} request
+     * @param {ClientsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.TooManyRequestsError}
+     * @throws {@link Management.InternalServerError}
+     * @throws {@link Management.GatewayTimeoutError}
+     *
+     * @example
+     *     await client.clients.search({
+     *         q: "q",
+     *         parser: "scim",
+     *         fields: "fields",
+     *         include_fields: true,
+     *         take: 1,
+     *         from: "from",
+     *         sort: "name"
+     *     })
+     */
+    search(request?: Management.SearchClientsRequestParameters, requestOptions?: ClientsClient.RequestOptions): Promise<core.Page<Management.ClientSearchResponse, Management.SearchClientsResponseContent>>;
     /**
      * Retrieve client details by ID. Clients are SSO connections or Applications linked with your Auth0 tenant. A list of fields to include or exclude may also be specified.
      * For more information, read [Applications in Auth0](https://www.auth0.com/docs/get-started/applications) and [Single Sign-On](https://www.auth0.com/docs/authenticate/single-sign-on).

package/dist/cjs/management/api/resources/clients/client/Client.js

@@ -426,6 +426,117 @@ class ClientsClient {
             return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/clients/cimd/register");
         });
     }
+    /**
+     * Search clients using SCIM or Lucene filter syntax with low-latency, eventually consistent results.
+     * Use the parser parameter to specify "scim" or "lucene" syntax (default: "lucene").
+     * This endpoint provides an alternative to the standard GET /clients endpoint with better performance
+     * for complex queries. Results may not reflect recent updates immediately.
+     *
+     * - This endpoint only supports `read:clients` and `read:client_summary` scopes. The `read:client_keys` and `read:client_credentials` scopes are not supported.
+     * - The following fields are never returned by this endpoint:
+     *   - `client_secret`
+     *   - `encryption_key`
+     *   - `signing_keys`
+     *   - `owners`
+     *   - `addons`
+     *
+     * @param {Management.SearchClientsRequestParameters} request
+     * @param {ClientsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link Management.BadRequestError}
+     * @throws {@link Management.UnauthorizedError}
+     * @throws {@link Management.ForbiddenError}
+     * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.TooManyRequestsError}
+     * @throws {@link Management.InternalServerError}
+     * @throws {@link Management.GatewayTimeoutError}
+     *
+     * @example
+     *     await client.clients.search({
+     *         q: "q",
+     *         parser: "scim",
+     *         fields: "fields",
+     *         include_fields: true,
+     *         take: 1,
+     *         from: "from",
+     *         sort: "name"
+     *     })
+     */
+    search() {
+        return __awaiter(this, arguments, void 0, function* (request = {}, requestOptions) {
+            const list = core.HttpResponsePromise.interceptFunction((request) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+                const { q, parser, fields, include_fields: includeFields, take = 50, from: from_, sort } = request;
+                const _queryParams = {
+                    q,
+                    parser: parser !== undefined ? parser : undefined,
+                    fields,
+                    include_fields: includeFields,
+                    take,
+                    from: from_,
+                    sort: sort !== undefined ? sort : undefined,
+                };
+                const _authRequest = yield this._options.authProvider.getAuthRequest();
+                let _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+                const _response = yield ((_b = this._options.fetcher) !== null && _b !== void 0 ? _b : core.fetcher)({
+                    url: core.url.join((_d = (_c = (yield core.Supplier.get(this._options.baseUrl))) !== null && _c !== void 0 ? _c : (yield core.Supplier.get(this._options.environment))) !== null && _d !== void 0 ? _d : environments.ManagementEnvironment.Default, "clients/search"),
+                    method: "GET",
+                    headers: _headers,
+                    queryString: core.url
+                        .queryBuilder()
+                        .addMany(_queryParams)
+                        .mergeAdditional(requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams)
+                        .build(),
+                    timeoutMs: ((_g = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _e !== void 0 ? _e : (_f = this._options) === null || _f === void 0 ? void 0 : _f.timeoutInSeconds) !== null && _g !== void 0 ? _g : 60) * 1000,
+                    maxRetries: (_h = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _h !== void 0 ? _h : (_j = this._options) === null || _j === void 0 ? void 0 : _j.maxRetries,
+                    abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                    fetchFn: (_k = this._options) === null || _k === void 0 ? void 0 : _k.fetch,
+                    logging: this._options.logging,
+                });
+                if (_response.ok) {
+                    return {
+                        data: _response.body,
+                        rawResponse: _response.rawResponse,
+                    };
+                }
+                if (_response.error.reason === "status-code") {
+                    switch (_response.error.statusCode) {
+                        case 400:
+                            throw new Management.BadRequestError(_response.error.body, _response.rawResponse);
+                        case 401:
+                            throw new Management.UnauthorizedError(_response.error.body, _response.rawResponse);
+                        case 403:
+                            throw new Management.ForbiddenError(_response.error.body, _response.rawResponse);
+                        case 404:
+                            throw new Management.NotFoundError(_response.error.body, _response.rawResponse);
+                        case 429:
+                            throw new Management.TooManyRequestsError(_response.error.body, _response.rawResponse);
+                        case 500:
+                            throw new Management.InternalServerError(_response.error.body, _response.rawResponse);
+                        case 504:
+                            throw new Management.GatewayTimeoutError(_response.error.body, _response.rawResponse);
+                        default:
+                            throw new errors.ManagementError({
+                                statusCode: _response.error.statusCode,
+                                body: _response.error.body,
+                                rawResponse: _response.rawResponse,
+                            });
+                    }
+                }
+                return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "GET", "/clients/search");
+            }));
+            const dataWithRawResponse = yield list(request).withRawResponse();
+            return new core.Page({
+                response: dataWithRawResponse.data,
+                rawResponse: dataWithRawResponse.rawResponse,
+                hasNextPage: (response) => (response === null || response === void 0 ? void 0 : response.next) != null && !(typeof (response === null || response === void 0 ? void 0 : response.next) === "string" && (response === null || response === void 0 ? void 0 : response.next) === ""),
+                getItems: (response) => { var _a; return (_a = response === null || response === void 0 ? void 0 : response.clients) !== null && _a !== void 0 ? _a : []; },
+                loadPage: (response) => {
+                    return list(core.setObjectProperty(request, "from", response === null || response === void 0 ? void 0 : response.next));
+                },
+            });
+        });
+    }
     /**
      * Retrieve client details by ID. Clients are SSO connections or Applications linked with your Auth0 tenant. A list of fields to include or exclude may also be specified.
      * For more information, read [Applications in Auth0](https://www.auth0.com/docs/get-started/applications) and [Single Sign-On](https://www.auth0.com/docs/authenticate/single-sign-on).

package/dist/cjs/management/api/types/types.d.ts

@@ -1920,6 +1920,12 @@ export interface BreachedPasswordDetectionStage {
     "pre-user-registration"?: Management.BreachedPasswordDetectionPreUserRegistrationStage | undefined;
     "pre-change-password"?: Management.BreachedPasswordDetectionPreChangePasswordStage | undefined;
 }
+/** Controls whether the BFP unblock form is submitted automatically or requires manual interaction. Canonical field; deprecated alias normalized upstream. */
+export declare const BruteForceProtectionFormSubmissionModeEnum: {
+    readonly Manual: "manual";
+    readonly Auto: "auto";
+};
+export type BruteForceProtectionFormSubmissionModeEnum = (typeof BruteForceProtectionFormSubmissionModeEnum)[keyof typeof BruteForceProtectionFormSubmissionModeEnum];
 /**
  * Account Lockout: Determines whether or not IP address is used when counting failed attempts.
  *           Possible values: <code>count_per_identifier_and_ip</code>, <code>count_per_identifier</code>.
@@ -2957,6 +2963,14 @@ export declare const ClientOidcSupportAllowedScopesEnum: {
     readonly Phone: "phone";
 };
 export type ClientOidcSupportAllowedScopesEnum = (typeof ClientOidcSupportAllowedScopesEnum)[keyof typeof ClientOidcSupportAllowedScopesEnum];
+/**
+ * OIDC support configuration for a client. Replaces the stored object entirely; send null to unset it.
+ */
+export interface ClientOidcSupportPatch {
+    is_allowed: boolean;
+    allow_all_scopes?: boolean | undefined;
+    allowed_scopes?: Management.ClientOidcSupportAllowedScopesEnum[] | undefined;
+}
 /**
  * OIDC support configuration for a client. Controls whether OIDC flows are allowed and which scopes the client may request.
  */
@@ -3030,6 +3044,113 @@ export interface ClientRefreshTokenPolicy {
     /** The resource server permissions granted under the Multi Resource Refresh Token Policy, defining the context in which an access token can be used */
     scope: string[];
 }
+export interface ClientSearchResponse {
+    /** ID of this client. */
+    client_id?: string | undefined;
+    /** The ISO 8601 timestamp of when this client was created. */
+    created_at?: string | undefined;
+    /** The ISO 8601 timestamp of when this client was last updated. */
+    updated_at?: string | undefined;
+    /** Name of the tenant this client belongs to. */
+    tenant?: string | undefined;
+    /** Name of this client (min length: 1 character, does not allow `<` or `>`). */
+    name?: string | undefined;
+    /** Free text description of this client (max length: 140 characters). */
+    description?: string | undefined;
+    /** Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false). */
+    global?: boolean | undefined;
+    app_type?: Management.ClientAppTypeEnum | undefined;
+    /** URL of the logo to display for this client. Recommended size is 150x150 pixels. */
+    logo_uri?: string | undefined;
+    /** Whether this client a first party client (true) or not (false). */
+    is_first_party?: boolean | undefined;
+    /** Whether this client conforms to <a href='https://auth0.com/docs/api-auth/tutorials/adoption'>strict OIDC specifications</a> (true) or uses legacy features (false). */
+    oidc_conformant?: boolean | undefined;
+    /** Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication. */
+    callbacks?: string[] | undefined;
+    /** Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs. */
+    allowed_origins?: string[] | undefined;
+    /** Comma-separated list of allowed origins for use with <a href='https://auth0.com/docs/cross-origin-authentication'>Cross-Origin Authentication</a>, <a href='https://auth0.com/docs/flows/concepts/device-auth'>Device Flow</a>, and <a href='https://auth0.com/docs/protocols/oauth2#how-response-mode-works'>web message response mode</a>. */
+    web_origins?: string[] | undefined;
+    /** List of audiences/realms for SAML protocol. Used by the wsfed addon. */
+    client_aliases?: string[] | undefined;
+    /** List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed. */
+    allowed_clients?: string[] | undefined;
+    /** Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains. */
+    allowed_logout_urls?: string[] | undefined;
+    session_transfer?: (Management.ClientSessionTransferConfiguration | null) | undefined;
+    oidc_logout?: Management.ClientOidcBackchannelLogoutSettings | undefined;
+    /** List of grant types supported for this application. Can include `authorization_code`, `implicit`, `refresh_token`, `client_credentials`, `password`, `http://auth0.com/oauth/grant-type/password-realm`, `http://auth0.com/oauth/grant-type/mfa-oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-recovery-code`, `urn:openid:params:grant-type:ciba`, `urn:ietf:params:oauth:grant-type:device_code`, and `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token`. */
+    grant_types?: string[] | undefined;
+    jwt_configuration?: Management.ClientJwtConfiguration | undefined;
+    /** Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false). */
+    sso?: boolean | undefined;
+    /** Whether Single Sign On is disabled (true) or enabled (true). Defaults to true. */
+    sso_disabled?: boolean | undefined;
+    /** Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false). */
+    cross_origin_authentication?: boolean | undefined;
+    /** URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page. */
+    cross_origin_loc?: string | undefined;
+    /** Whether a custom login page is to be used (true) or the default provided login page (false). */
+    custom_login_page_on?: boolean | undefined;
+    /** The content (HTML, CSS, JS) of the custom login page. */
+    custom_login_page?: string | undefined;
+    /** The content (HTML, CSS, JS) of the custom login page. (Used on Previews) */
+    custom_login_page_preview?: string | undefined;
+    /** HTML form template to be used for WS-Federation. */
+    form_template?: string | undefined;
+    token_endpoint_auth_method?: Management.ClientTokenEndpointAuthMethodEnum | undefined;
+    /** If true, trust that the IP specified in the `auth0-forwarded-for` header is the end-user's IP for brute-force-protection on token endpoint. */
+    is_token_endpoint_ip_header_trusted?: boolean | undefined;
+    client_metadata?: Management.ClientMetadata | undefined;
+    mobile?: Management.ClientMobile | undefined;
+    /** Initiate login uri, must be https */
+    initiate_login_uri?: string | undefined;
+    native_social_login?: Management.NativeSocialLogin | undefined;
+    fedcm_login?: Management.FedCmLogin | undefined;
+    refresh_token?: (Management.ClientRefreshTokenConfiguration | null) | undefined;
+    default_organization?: (Management.ClientDefaultOrganization | null) | undefined;
+    organization_usage?: Management.ClientOrganizationUsageEnum | undefined;
+    organization_require_behavior?: Management.ClientOrganizationRequireBehaviorEnum | undefined;
+    /** Defines the available methods for organization discovery during the `pre_login_prompt`. Users can discover their organization either by `email`, `organization_name` or both. */
+    organization_discovery_methods?: Management.ClientOrganizationDiscoveryEnum[] | undefined;
+    client_authentication_methods?: (Management.ClientAuthenticationMethod | null) | undefined;
+    /** Makes the use of Pushed Authorization Requests mandatory for this client */
+    require_pushed_authorization_requests?: boolean | undefined;
+    /** Makes the use of Proof-of-Possession mandatory for this client */
+    require_proof_of_possession?: boolean | undefined;
+    signed_request_object?: Management.ClientSignedRequestObjectWithCredentialId | undefined;
+    token_vault_privileged_access?: Management.ClientTokenVaultPrivilegedAccessWithCredentialId | undefined;
+    compliance_level?: (Management.ClientComplianceLevelEnum | null) | undefined;
+    /**
+     * Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
+     * If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
+     * See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.
+     */
+    skip_non_verifiable_callback_uri_confirmation_prompt?: boolean | undefined;
+    token_exchange?: Management.ClientTokenExchangeConfiguration | undefined;
+    /** Specifies how long, in seconds, a Pushed Authorization Request URI remains valid */
+    par_request_expiry?: (number | null) | undefined;
+    token_quota?: Management.TokenQuota | undefined;
+    express_configuration?: Management.ExpressConfiguration | undefined;
+    b2b_integration_configuration?: Management.B2BIntegrationConfiguration | undefined;
+    my_organization_configuration?: Management.ClientMyOrganizationResponseConfiguration | undefined;
+    identity_assertion_authorization_grant?: Management.IdentityAssertionAuthorizationGrant | undefined;
+    anonymous_sessions?: Management.AnonymousSessions | undefined;
+    third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
+    /** The identifier of the resource server that this client is linked to. */
+    resource_server_identifier?: string | undefined;
+    async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
+    external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
+    external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
+    external_client_id?: string | undefined;
+    /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
+    jwks_uri?: string | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export declare const ClientSessionTransferAllowedAuthenticationMethodsEnum: {
     readonly Cookie: "cookie";
     readonly Query: "query";
@@ -3102,6 +3223,12 @@ export interface ClientSigningKey {
  * Signing certificates associated with this client.
  */
 export type ClientSigningKeys = (Management.ClientSigningKey[] | null) | undefined;
+/** Field name to sort results by in ascending order. Defaults to insertion order (oldest first) if not provided. */
+export declare const ClientSortFieldEnum: {
+    readonly Name: "name";
+    readonly UpdatedAt: "updated_at";
+};
+export type ClientSortFieldEnum = (typeof ClientSortFieldEnum)[keyof typeof ClientSortFieldEnum];
 /** Security mode for third-party clients. `strict` enforces <a href="https://auth0.com/docs/get-started/applications/third-party-applications/security-controls">enhanced security controls</a>: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. `permissive` preserves <a href="https://auth0.com/docs/get-started/applications/third-party-applications/permissive-mode">pre-existing behavior</a> and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified. */
 export declare const ClientThirdPartySecurityModeEnum: {
     readonly Strict: "strict";
@@ -27524,6 +27651,7 @@ export interface GetBruteForceSettingsResponseContent {
     mode?: Management.BruteForceProtectionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface GetClientCredentialResponseContent {
     /** ID of the credential. Generated on creation. */
@@ -31944,6 +32072,12 @@ export declare const ScreenGroupNameEnum: {
     readonly AsyncApprovalWrongUser: "async-approval-wrong-user";
 };
 export type ScreenGroupNameEnum = (typeof ScreenGroupNameEnum)[keyof typeof ScreenGroupNameEnum];
+export interface SearchClientsResponseContent {
+    /** Array of client objects matching the search criteria. */
+    clients: Management.ClientSearchResponse[];
+    /** Cursor for retrieving the next page of results. Absent when no more results are available. */
+    next?: string | undefined;
+}
 /** The version of the search engine */
 export declare const SearchEngineVersionsEnum: {
     readonly V1: "v1";
@@ -33348,6 +33482,7 @@ export interface UpdateBruteForceSettingsResponseContent {
     mode?: Management.BruteForceProtectionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface UpdateClientGrantResponseContent {
     /** ID of the client grant. */