auth0 7.4.0 → 7.5.0

package/dist/cjs/management/api/types/types.d.ts

@@ -732,6 +732,18 @@ export declare const OauthScope: {
     /**
      * Delete Vdcs Templates */
     readonly DeleteVdcsTemplates: "delete:vdcs_templates";
+    /**
+     * Create Client Profiles */
+    readonly CreateClientProfiles: "create:client_profiles";
+    /**
+     * Read Client Profiles */
+    readonly ReadClientProfiles: "read:client_profiles";
+    /**
+     * Update Client Profiles */
+    readonly UpdateClientProfiles: "update:client_profiles";
+    /**
+     * Delete Client Profiles */
+    readonly DeleteClientProfiles: "delete:client_profiles";
     /**
      * Create Organization Client Associations */
     readonly CreateOrganizationClients: "create:organization_clients";
@@ -1433,6 +1445,60 @@ export interface AttackProtectionCaptchaHcaptchaResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * An attack protection policy override for CAPTCHA.
+ */
+export interface AttackProtectionCaptchaPolicy {
+    /** System-generated identifier for the policy. */
+    id: string;
+    /** Human-readable policy name. */
+    name: string;
+    /** Description of the policy's purpose. */
+    description?: string | undefined;
+    /** Conflict resolution order. Lower number takes higher precedence. */
+    priority: number;
+    match: Management.AttackProtectionCaptchaPolicyMatch;
+    action: Management.AttackProtectionCaptchaPolicyAction;
+    /** ISO 8601 timestamp when the policy was created. */
+    created_at: string;
+    /** ISO 8601 timestamp when the policy was last updated. */
+    updated_at: string;
+}
+/**
+ * CAPTCHA configuration override stored for this policy.
+ */
+export interface AttackProtectionCaptchaPolicyAction {
+    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
+    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
+    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
+    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2 | undefined;
+    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterprise | undefined;
+    hcaptcha?: Management.CaptchaPolicyActionHcaptcha | undefined;
+    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptcha | undefined;
+    arkose?: Management.CaptchaPolicyActionArkose | undefined;
+}
+/**
+ * CAPTCHA configuration override for this policy.
+ */
+export interface AttackProtectionCaptchaPolicyActionInput {
+    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
+    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
+    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
+    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2Input | undefined;
+    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterpriseInput | undefined;
+    hcaptcha?: Management.CaptchaPolicyActionHcaptchaInput | undefined;
+    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptchaInput | undefined;
+    arkose?: Management.CaptchaPolicyActionArkoseInput | undefined;
+}
+/**
+ * Traffic matching criteria for the policy. Exactly one of auth0_managed or geo_country_codes must be specified.
+ */
+export interface AttackProtectionCaptchaPolicyMatch {
+    /** Match by Auth0-managed traffic identifiers. */
+    auth0_managed?: string[] | undefined;
+    /** Match by ISO 3166-1 alpha-2 country codes. */
+    geo_country_codes?: string[] | undefined;
+}
 /** The id of the active provider for the CAPTCHA. */
 export declare const AttackProtectionCaptchaProviderId: {
     readonly Arkose: "arkose";
@@ -1945,6 +2011,125 @@ export interface BulkUpdateAculResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** The CAPTCHA provider type. */
+export declare const CaptchaActiveProviderEnum: {
+    readonly SimpleCaptcha: "simple_captcha";
+    readonly AuthChallenge: "auth_challenge";
+    readonly RecaptchaV2: "recaptcha_v2";
+    readonly RecaptchaEnterprise: "recaptcha_enterprise";
+    readonly Hcaptcha: "hcaptcha";
+    readonly FriendlyCaptcha: "friendly_captcha";
+    readonly Arkose: "arkose";
+};
+export type CaptchaActiveProviderEnum = (typeof CaptchaActiveProviderEnum)[keyof typeof CaptchaActiveProviderEnum];
+/**
+ * Arkose Labs provider configuration.
+ */
+export interface CaptchaPolicyActionArkose {
+    /** The Arkose Labs site key. */
+    site_key?: string | undefined;
+    /** The Arkose Labs client subdomain. */
+    client_subdomain?: string | undefined;
+    /** The Arkose Labs verify subdomain. */
+    verify_subdomain?: string | undefined;
+    /** Whether to allow access when Arkose Labs is unavailable. */
+    fail_open?: boolean | undefined;
+}
+/**
+ * Arkose Labs provider configuration.
+ */
+export interface CaptchaPolicyActionArkoseInput {
+    /** The Arkose Labs site key. */
+    site_key?: string | undefined;
+    /** The Arkose Labs private key. Encrypted at rest. */
+    secret?: string | undefined;
+    /** The Arkose Labs client subdomain. */
+    client_subdomain?: string | undefined;
+    /** The Arkose Labs verify subdomain. */
+    verify_subdomain?: string | undefined;
+    /** Whether to allow access when Arkose Labs is unavailable. */
+    fail_open?: boolean | undefined;
+}
+/**
+ * Auth Challenge CAPTCHA provider configuration.
+ */
+export interface CaptchaPolicyActionAuthChallenge {
+    /** Whether to allow access when the challenge provider is unavailable. */
+    fail_open?: boolean | undefined;
+}
+/**
+ * Friendly Captcha provider configuration.
+ */
+export interface CaptchaPolicyActionFriendlyCaptcha {
+    /** The Friendly Captcha site key. */
+    site_key?: string | undefined;
+}
+/**
+ * Friendly Captcha provider configuration.
+ */
+export interface CaptchaPolicyActionFriendlyCaptchaInput {
+    /** The Friendly Captcha site key. */
+    site_key?: string | undefined;
+    /** The Friendly Captcha secret key. Encrypted at rest. */
+    secret?: string | undefined;
+}
+/**
+ * hCaptcha provider configuration.
+ */
+export interface CaptchaPolicyActionHcaptcha {
+    /** The hCaptcha site key. */
+    site_key?: string | undefined;
+}
+/**
+ * hCaptcha provider configuration.
+ */
+export interface CaptchaPolicyActionHcaptchaInput {
+    /** The hCaptcha site key. */
+    site_key?: string | undefined;
+    /** The hCaptcha secret key. Encrypted at rest. */
+    secret?: string | undefined;
+}
+/**
+ * reCAPTCHA Enterprise provider configuration.
+ */
+export interface CaptchaPolicyActionRecaptchaEnterprise {
+    /** The reCAPTCHA Enterprise site key. */
+    site_key?: string | undefined;
+    /** The Google Cloud project ID. */
+    project_id?: string | undefined;
+}
+/**
+ * reCAPTCHA Enterprise provider configuration.
+ */
+export interface CaptchaPolicyActionRecaptchaEnterpriseInput {
+    /** The reCAPTCHA Enterprise site key. */
+    site_key?: string | undefined;
+    /** The Google Cloud project ID. */
+    project_id?: string | undefined;
+    /** The reCAPTCHA Enterprise API key. Encrypted at rest. */
+    api_key?: string | undefined;
+}
+/**
+ * reCAPTCHA v2 provider configuration.
+ */
+export interface CaptchaPolicyActionRecaptchaV2 {
+    /** The reCAPTCHA v2 site key. */
+    site_key?: string | undefined;
+}
+/**
+ * reCAPTCHA v2 provider configuration.
+ */
+export interface CaptchaPolicyActionRecaptchaV2Input {
+    /** The reCAPTCHA v2 site key. */
+    site_key?: string | undefined;
+    /** The reCAPTCHA v2 secret key. Encrypted at rest. */
+    secret?: string | undefined;
+}
+/**
+ * Simple CAPTCHA provider configuration.
+ */
+export interface CaptchaPolicyActionSimpleCaptcha {
+}
 export interface CertificateSubjectDnCredential {
     credential_type: Management.CertificateSubjectDnCredentialTypeEnum;
     /** Friendly name for a credential. */
@@ -1974,6 +2159,12 @@ export interface ChangePasswordTicketResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/** Indicates who created the client. The value <code>admin</code> indicates the client was registered via the Management API. The value <code>client</code> indicates the client was registered dynamically. */
+export declare const CimdExternalMetadataCreatedByEnum: {
+    readonly Admin: "admin";
+    readonly Client: "client";
+};
+export type CimdExternalMetadataCreatedByEnum = (typeof CimdExternalMetadataCreatedByEnum)[keyof typeof CimdExternalMetadataCreatedByEnum];
 /**
  * Client authentication methods derived from the JWKS document
  */
@@ -2146,6 +2337,7 @@ export interface Client {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -2713,6 +2905,12 @@ export declare const ClientExternalMetadataCreatedByEnum: {
     readonly Client: "client";
 };
 export type ClientExternalMetadataCreatedByEnum = (typeof ClientExternalMetadataCreatedByEnum)[keyof typeof ClientExternalMetadataCreatedByEnum];
+/** Indicates whether the Client ID Metadata Document at <code>external_client_id</code> is currently reachable. For clients with <code>external_metadata_created_by</code> set to <code>client</code> the status is calculated from the document; for <code>admin</code> it is always <code>available</code>. When absent, the status is assumed to be <code>available</code>. */
+export declare const ClientExternalMetadataStatusEnum: {
+    readonly Available: "available";
+    readonly Unavailable: "unavailable";
+};
+export type ClientExternalMetadataStatusEnum = (typeof ClientExternalMetadataStatusEnum)[keyof typeof ClientExternalMetadataStatusEnum];
 /** Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document. The value <code>dcr</code> identifies clients registered via Dynamic Client Registration. */
 export declare const ClientExternalMetadataTypeEnum: {
     readonly Cimd: "cimd";
@@ -2763,6 +2961,12 @@ export interface ClientGrantResponseContent {
     /** If enabled, all scopes configured on the resource server are allowed for this grant. */
     allow_all_scopes?: boolean | undefined;
 }
+/** Field name to sort results by in ascending order. Defaults to insertion order (oldest first) if not provided. */
+export declare const ClientGrantSortFieldEnum: {
+    readonly Audience: "audience";
+    readonly UpdatedAt: "updated_at";
+};
+export type ClientGrantSortFieldEnum = (typeof ClientGrantSortFieldEnum)[keyof typeof ClientGrantSortFieldEnum];
 /** The type of application access the client grant allows. */
 export declare const ClientGrantSubjectTypeEnum: {
     readonly Client: "client";
@@ -3021,6 +3225,126 @@ export declare const ClientOrganizationUsagePatchEnum: {
     readonly Require: "require";
 };
 export type ClientOrganizationUsagePatchEnum = (typeof ClientOrganizationUsagePatchEnum)[keyof typeof ClientOrganizationUsagePatchEnum];
+export interface ClientProfile {
+    id: Management.ClientProfileId;
+    name: Management.ClientProfileName;
+    description?: ((Management.ClientProfileDescription | undefined) | null) | undefined;
+    client_configuration: Management.ClientProfileClientConfiguration;
+    apply_policy: Management.ClientProfileApplyPolicy;
+    /** Timestamp of creation. */
+    created_at?: string | undefined;
+    /** Timestamp of last update. */
+    updated_at?: string | undefined;
+}
+/**
+ * Runtime matching rules that determine which clients this profile governs.
+ */
+export interface ClientProfileApplyPolicy {
+    external_metadata_type: Management.ClientProfileApplyPolicyExternalMetadataTypeEnum;
+    external_metadata_created_by: Management.ClientProfileApplyPolicyExternalMetadataCreatedByEnum;
+}
+/** The external metadata client's creator to match. The value <code>client</code> indicates the client was registered dynamically. */
+export declare const ClientProfileApplyPolicyExternalMetadataCreatedByEnum: {
+    readonly Client: "client";
+};
+export type ClientProfileApplyPolicyExternalMetadataCreatedByEnum = (typeof ClientProfileApplyPolicyExternalMetadataCreatedByEnum)[keyof typeof ClientProfileApplyPolicyExternalMetadataCreatedByEnum];
+/** The client's type of external metadata to match. The value <code>cimd</code> identifies clients registered via a Client ID Metadata Document. */
+export declare const ClientProfileApplyPolicyExternalMetadataTypeEnum: {
+    readonly Cimd: "cimd";
+};
+export type ClientProfileApplyPolicyExternalMetadataTypeEnum = (typeof ClientProfileApplyPolicyExternalMetadataTypeEnum)[keyof typeof ClientProfileApplyPolicyExternalMetadataTypeEnum];
+/**
+ * Runtime policy applied to matched clients. Omitted fields fall back to each client's own setting.
+ */
+export interface ClientProfileClientConfiguration {
+    refresh_token?: Management.ClientProfileClientConfigurationRefreshToken | undefined;
+    organization_usage?: Management.ClientProfileClientConfigurationOrganizationUsage | undefined;
+    organization_require_behavior?: Management.ClientProfileClientConfigurationOrganizationRequireBehavior | undefined;
+    organization_discovery_methods?: Management.ClientProfileClientConfigurationOrganizationDiscoveryMethods | undefined;
+    require_proof_of_possession?: Management.ClientProfileClientConfigurationRequireProofOfPossession | undefined;
+}
+/** A method used to discover a user's organization. */
+export declare const ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum: {
+    readonly Email: "email";
+    readonly OrganizationName: "organization_name";
+};
+export type ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum = (typeof ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum)[keyof typeof ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum];
+/**
+ * Default organization discovery methods applied to matched clients.
+ */
+export interface ClientProfileClientConfigurationOrganizationDiscoveryMethods {
+    default_value?: Management.ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum[] | undefined;
+}
+/**
+ * Default organization prompt behavior applied to matched clients.
+ */
+export interface ClientProfileClientConfigurationOrganizationRequireBehavior {
+    default_value?: Management.ClientProfileClientConfigurationOrganizationRequireBehaviorEnum | undefined;
+}
+/** When an organization is required, how matched clients prompt for it. */
+export declare const ClientProfileClientConfigurationOrganizationRequireBehaviorEnum: {
+    readonly NoPrompt: "no_prompt";
+    readonly PreLoginPrompt: "pre_login_prompt";
+    readonly PostLoginPrompt: "post_login_prompt";
+};
+export type ClientProfileClientConfigurationOrganizationRequireBehaviorEnum = (typeof ClientProfileClientConfigurationOrganizationRequireBehaviorEnum)[keyof typeof ClientProfileClientConfigurationOrganizationRequireBehaviorEnum];
+/**
+ * Default organization usage applied to matched clients.
+ */
+export interface ClientProfileClientConfigurationOrganizationUsage {
+    default_value?: Management.ClientProfileClientConfigurationOrganizationUsageEnum | undefined;
+}
+/** How matched clients handle organizations. */
+export declare const ClientProfileClientConfigurationOrganizationUsageEnum: {
+    readonly Deny: "deny";
+    readonly Allow: "allow";
+    readonly Require: "require";
+};
+export type ClientProfileClientConfigurationOrganizationUsageEnum = (typeof ClientProfileClientConfigurationOrganizationUsageEnum)[keyof typeof ClientProfileClientConfigurationOrganizationUsageEnum];
+/**
+ * Refresh token settings. Omit any sub-field to use the client's own value.
+ */
+export interface ClientProfileClientConfigurationRefreshToken {
+    token_lifetime?: Management.ClientProfileRefreshTokenTokenLifetime | undefined;
+    idle_token_lifetime?: Management.ClientProfileRefreshTokenIdleTokenLifetime | undefined;
+    leeway?: Management.ClientProfileRefreshTokenLeeway | undefined;
+}
+/**
+ * Whether matched clients default to requiring proof of possession.
+ */
+export interface ClientProfileClientConfigurationRequireProofOfPossession {
+    default_value?: boolean | undefined;
+}
+/**
+ * Optional description of the client profile.
+ */
+export type ClientProfileDescription = (string | null) | undefined;
+/**
+ * Client Profile identifier.
+ */
+export type ClientProfileId = string;
+/**
+ * Display name of the client profile.
+ */
+export type ClientProfileName = string;
+/**
+ * Default idle refresh token lifetime, in seconds, applied to matched clients.
+ */
+export interface ClientProfileRefreshTokenIdleTokenLifetime {
+    default_value?: number | undefined;
+}
+/**
+ * Default refresh token rotation leeway, in seconds, applied to matched clients.
+ */
+export interface ClientProfileRefreshTokenLeeway {
+    default_value?: number | undefined;
+}
+/**
+ * Default refresh token lifetime, in seconds, applied to matched clients.
+ */
+export interface ClientProfileRefreshTokenTokenLifetime {
+    default_value?: number | undefined;
+}
 /** Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows. `open_redirect_protection` shows an error page instead of redirecting, and hides the callback domain from email templates. `allow_always` enables standard redirect behavior. Defaults to `open_redirect_protection` for third-party clients. Only applies when `is_first_party` is `false` and `third_party_security_mode` is `strict`. To learn more, read <a href="https://auth0.com/docs/get-started/applications/third-party-applications/security-controls#redirect-protection">Redirect protection</a>. */
 export declare const ClientRedirectionPolicyEnum: {
     readonly AllowAlways: "allow_always";
@@ -3153,6 +3477,7 @@ export interface ClientSearchResponse {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -7703,6 +8028,7 @@ export interface CreateClientResponseContent {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -28015,6 +28341,7 @@ export interface GetClientResponseContent {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -29043,6 +29370,8 @@ export interface GetTenantSettingsResponseContent {
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
     /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
     client_id_metadata_document_supported?: boolean | undefined;
+    /** Whether the authorization server supports registering clients dynamically from a client_id URL. Requires client_id_metadata_document_supported to be enabled. */
+    client_id_metadata_document_dynamic_registration_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */
@@ -29662,6 +29991,10 @@ export interface ListAgentsResponseContent {
     /** A cursor to be used as the "from" query parameter for the next page of results. Omitted when there are no further results. */
     next?: string | undefined;
 }
+/**
+ * List of CAPTCHA attack protection policies for the tenant, sorted by priority ascending.
+ */
+export type ListAttackProtectionCaptchaPoliciesResponseContent = Management.AttackProtectionCaptchaPolicy[];
 export interface ListBrandingPhoneProvidersResponseContent {
     providers?: Management.PhoneProviderSchemaMasked[] | undefined;
 }
@@ -29682,6 +30015,14 @@ export interface ListClientGrantPaginatedResponseContent {
     next?: string | undefined;
     client_grants?: Management.ClientGrantResponseContent[] | undefined;
 }
+/**
+ * Checkpoint paginated list of client profiles.
+ */
+export interface ListClientProfilesPaginatedResponseContent {
+    /** A cursor to be used as the "from" query parameter for the next page of results. */
+    next?: string | undefined;
+    client_profiles: Management.ClientProfile[];
+}
 export interface ListClientsOffsetPaginatedResponseContent {
     start?: number | undefined;
     limit?: number | undefined;
@@ -31341,6 +31682,7 @@ export type PreferredAuthenticationMethodEnum = (typeof PreferredAuthenticationM
 export interface PreviewCimdMetadataResponseContent {
     /** The client_id of an existing client registered with this external_client_id, if one exists. */
     client_id?: string | undefined;
+    external_metadata_created_by?: Management.CimdExternalMetadataCreatedByEnum | undefined;
     /** Array of retrieval errors (populated when the metadata document could not be fetched). When present, validation is omitted. */
     errors?: string[] | undefined;
     validation?: Management.CimdValidationResult | undefined;
@@ -32092,6 +32434,7 @@ export interface RotateClientSecretResponseContent {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -32296,6 +32639,12 @@ export declare const ScreenGroupNameEnum: {
     readonly AsyncApprovalWrongUser: "async-approval-wrong-user";
 };
 export type ScreenGroupNameEnum = (typeof ScreenGroupNameEnum)[keyof typeof ScreenGroupNameEnum];
+export interface SearchClientGrantsResponseContent {
+    /** Array of client grant objects matching the search criteria. */
+    client_grants: Management.ClientGrantResponseContent[];
+    /** Cursor for retrieving the next page of results. Omitted if there are no more results. */
+    next?: string | undefined;
+}
 export interface SearchClientsResponseContent {
     /** Array of client objects matching the search criteria. */
     clients: Management.ClientSearchResponse[];
@@ -33845,6 +34194,7 @@ export interface UpdateClientResponseContent {
     async_approval_notification_channels?: Management.ClientAsyncApprovalNotificationsChannelsApiPostConfiguration | undefined;
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
+    external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -34893,6 +35243,8 @@ export interface UpdateTenantSettingsResponseContent {
     resource_parameter_profile?: Management.TenantSettingsResourceParameterProfile | undefined;
     /** Whether the authorization server supports retrieving client metadata from a client_id URL. */
     client_id_metadata_document_supported?: boolean | undefined;
+    /** Whether the authorization server supports registering clients dynamically from a client_id URL. Requires client_id_metadata_document_supported to be enabled. */
+    client_id_metadata_document_dynamic_registration_supported?: boolean | undefined;
     /** Whether Phone Consolidated Experience is enabled for this tenant. */
     phone_consolidated_experience?: boolean | undefined;
     /** Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant. */