auth0 7.5.0 → 7.7.0

package/dist/esm/management/api/types/types.d.mts

@@ -756,6 +756,18 @@ export declare const OauthScope: {
     /**
      * Delete Organization Client Associations */
     readonly DeleteOrganizationClients: "delete:organization_clients";
+    /**
+     * Create Universal Portals */
+    readonly CreatePortals: "create:portals";
+    /**
+     * Read Universal Portals */
+    readonly ReadPortals: "read:portals";
+    /**
+     * Update Universal Portals */
+    readonly UpdatePortals: "update:portals";
+    /**
+     * Delete Universal Portals */
+    readonly DeletePortals: "delete:portals";
     /**
      * Create Network ACL Keys */
     readonly CreateNetworkAclKeys: "create:network_acl_keys";
@@ -789,6 +801,17 @@ export declare namespace TooManyRequestsErrorBody {
     };
     type Error_ = (typeof Error_)[keyof typeof Error_];
 }
+export interface InternalServerErrorBody {
+    message: string;
+    statusCode: string;
+    error: InternalServerErrorBody.Error_;
+}
+export declare namespace InternalServerErrorBody {
+    const Error_: {
+        readonly InternalServerError: "Internal Server Error";
+    };
+    type Error_ = (typeof Error_)[keyof typeof Error_];
+}
 export interface Action {
     /** The unique ID of the action. */
     id?: string | undefined;
@@ -1445,60 +1468,6 @@ export interface AttackProtectionCaptchaHcaptchaResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * An attack protection policy override for CAPTCHA.
- */
-export interface AttackProtectionCaptchaPolicy {
-    /** System-generated identifier for the policy. */
-    id: string;
-    /** Human-readable policy name. */
-    name: string;
-    /** Description of the policy's purpose. */
-    description?: string | undefined;
-    /** Conflict resolution order. Lower number takes higher precedence. */
-    priority: number;
-    match: Management.AttackProtectionCaptchaPolicyMatch;
-    action: Management.AttackProtectionCaptchaPolicyAction;
-    /** ISO 8601 timestamp when the policy was created. */
-    created_at: string;
-    /** ISO 8601 timestamp when the policy was last updated. */
-    updated_at: string;
-}
-/**
- * CAPTCHA configuration override stored for this policy.
- */
-export interface AttackProtectionCaptchaPolicyAction {
-    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
-    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
-    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
-    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2 | undefined;
-    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterprise | undefined;
-    hcaptcha?: Management.CaptchaPolicyActionHcaptcha | undefined;
-    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptcha | undefined;
-    arkose?: Management.CaptchaPolicyActionArkose | undefined;
-}
-/**
- * CAPTCHA configuration override for this policy.
- */
-export interface AttackProtectionCaptchaPolicyActionInput {
-    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
-    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
-    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
-    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2Input | undefined;
-    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterpriseInput | undefined;
-    hcaptcha?: Management.CaptchaPolicyActionHcaptchaInput | undefined;
-    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptchaInput | undefined;
-    arkose?: Management.CaptchaPolicyActionArkoseInput | undefined;
-}
-/**
- * Traffic matching criteria for the policy. Exactly one of auth0_managed or geo_country_codes must be specified.
- */
-export interface AttackProtectionCaptchaPolicyMatch {
-    /** Match by Auth0-managed traffic identifiers. */
-    auth0_managed?: string[] | undefined;
-    /** Match by ISO 3166-1 alpha-2 country codes. */
-    geo_country_codes?: string[] | undefined;
-}
 /** The id of the active provider for the CAPTCHA. */
 export declare const AttackProtectionCaptchaProviderId: {
     readonly Arkose: "arkose";
@@ -2011,125 +1980,6 @@ export interface BulkUpdateAculResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/** The CAPTCHA provider type. */
-export declare const CaptchaActiveProviderEnum: {
-    readonly SimpleCaptcha: "simple_captcha";
-    readonly AuthChallenge: "auth_challenge";
-    readonly RecaptchaV2: "recaptcha_v2";
-    readonly RecaptchaEnterprise: "recaptcha_enterprise";
-    readonly Hcaptcha: "hcaptcha";
-    readonly FriendlyCaptcha: "friendly_captcha";
-    readonly Arkose: "arkose";
-};
-export type CaptchaActiveProviderEnum = (typeof CaptchaActiveProviderEnum)[keyof typeof CaptchaActiveProviderEnum];
-/**
- * Arkose Labs provider configuration.
- */
-export interface CaptchaPolicyActionArkose {
-    /** The Arkose Labs site key. */
-    site_key?: string | undefined;
-    /** The Arkose Labs client subdomain. */
-    client_subdomain?: string | undefined;
-    /** The Arkose Labs verify subdomain. */
-    verify_subdomain?: string | undefined;
-    /** Whether to allow access when Arkose Labs is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Arkose Labs provider configuration.
- */
-export interface CaptchaPolicyActionArkoseInput {
-    /** The Arkose Labs site key. */
-    site_key?: string | undefined;
-    /** The Arkose Labs private key. Encrypted at rest. */
-    secret?: string | undefined;
-    /** The Arkose Labs client subdomain. */
-    client_subdomain?: string | undefined;
-    /** The Arkose Labs verify subdomain. */
-    verify_subdomain?: string | undefined;
-    /** Whether to allow access when Arkose Labs is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Auth Challenge CAPTCHA provider configuration.
- */
-export interface CaptchaPolicyActionAuthChallenge {
-    /** Whether to allow access when the challenge provider is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Friendly Captcha provider configuration.
- */
-export interface CaptchaPolicyActionFriendlyCaptcha {
-    /** The Friendly Captcha site key. */
-    site_key?: string | undefined;
-}
-/**
- * Friendly Captcha provider configuration.
- */
-export interface CaptchaPolicyActionFriendlyCaptchaInput {
-    /** The Friendly Captcha site key. */
-    site_key?: string | undefined;
-    /** The Friendly Captcha secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * hCaptcha provider configuration.
- */
-export interface CaptchaPolicyActionHcaptcha {
-    /** The hCaptcha site key. */
-    site_key?: string | undefined;
-}
-/**
- * hCaptcha provider configuration.
- */
-export interface CaptchaPolicyActionHcaptchaInput {
-    /** The hCaptcha site key. */
-    site_key?: string | undefined;
-    /** The hCaptcha secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * reCAPTCHA Enterprise provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaEnterprise {
-    /** The reCAPTCHA Enterprise site key. */
-    site_key?: string | undefined;
-    /** The Google Cloud project ID. */
-    project_id?: string | undefined;
-}
-/**
- * reCAPTCHA Enterprise provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaEnterpriseInput {
-    /** The reCAPTCHA Enterprise site key. */
-    site_key?: string | undefined;
-    /** The Google Cloud project ID. */
-    project_id?: string | undefined;
-    /** The reCAPTCHA Enterprise API key. Encrypted at rest. */
-    api_key?: string | undefined;
-}
-/**
- * reCAPTCHA v2 provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaV2 {
-    /** The reCAPTCHA v2 site key. */
-    site_key?: string | undefined;
-}
-/**
- * reCAPTCHA v2 provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaV2Input {
-    /** The reCAPTCHA v2 site key. */
-    site_key?: string | undefined;
-    /** The reCAPTCHA v2 secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * Simple CAPTCHA provider configuration.
- */
-export interface CaptchaPolicyActionSimpleCaptcha {
-}
 export interface CertificateSubjectDnCredential {
     credential_type: Management.CertificateSubjectDnCredentialTypeEnum;
     /** Friendly name for a credential. */
@@ -2331,6 +2181,7 @@ export interface Client {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -2338,6 +2189,8 @@ export interface Client {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -3168,6 +3021,16 @@ export interface ClientOidcBackchannelLogoutSettings {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * OIDC support configuration for this client.
+ */
+export interface ClientOidcSupport {
+    is_allowed?: boolean | undefined;
+    allow_all_scopes?: boolean | undefined;
+    allowed_scopes?: Management.ClientOidcSupportAllowedScopesEnum[] | undefined;
+    /** Accepts any additional properties */
+    [key: string]: any;
+}
 export declare const ClientOidcSupportAllowedScopesEnum: {
     readonly Profile: "profile";
     readonly Email: "email";
@@ -3262,6 +3125,32 @@ export interface ClientProfileClientConfiguration {
     organization_require_behavior?: Management.ClientProfileClientConfigurationOrganizationRequireBehavior | undefined;
     organization_discovery_methods?: Management.ClientProfileClientConfigurationOrganizationDiscoveryMethods | undefined;
     require_proof_of_possession?: Management.ClientProfileClientConfigurationRequireProofOfPossession | undefined;
+    oidc_support?: Management.ClientProfileClientConfigurationOidcSupport | undefined;
+}
+/**
+ * Default OIDC support applied to matched clients.
+ */
+export interface ClientProfileClientConfigurationOidcSupport {
+    default_value: Management.ClientProfileClientConfigurationOidcSupportDefaultValue;
+}
+/** Optional OIDC scope that matched clients may be granted. */
+export declare const ClientProfileClientConfigurationOidcSupportAllowedScopesEnum: {
+    readonly Profile: "profile";
+    readonly Email: "email";
+    readonly Address: "address";
+    readonly Phone: "phone";
+};
+export type ClientProfileClientConfigurationOidcSupportAllowedScopesEnum = (typeof ClientProfileClientConfigurationOidcSupportAllowedScopesEnum)[keyof typeof ClientProfileClientConfigurationOidcSupportAllowedScopesEnum];
+/**
+ * OIDC support settings applied to matched clients.
+ */
+export interface ClientProfileClientConfigurationOidcSupportDefaultValue {
+    /** Whether matched clients may use OIDC. */
+    is_allowed: boolean;
+    /** Whether matched clients may request all optional OIDC scopes. Cannot be combined with allowed_scopes. */
+    allow_all_scopes?: boolean | undefined;
+    /** Optional OIDC scopes that matched clients may request. */
+    allowed_scopes?: Management.ClientProfileClientConfigurationOidcSupportAllowedScopesEnum[] | undefined;
 }
 /** A method used to discover a user's organization. */
 export declare const ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum: {
@@ -3471,6 +3360,7 @@ export interface ClientSearchResponse {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -3478,6 +3368,8 @@ export interface ClientSearchResponse {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -3875,6 +3767,10 @@ export type ConnectionClientIdOidc = string;
  * OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
  */
 export type ConnectionClientIdPaypal = string;
+/**
+ * OIDC client identifier issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging SAML Assertions for Refresh Tokens.
+ */
+export type ConnectionClientIdSamlxaaRequestingApp = Management.ConnectionClientIdOidc;
 /**
  * The OAuth 2.0 client identifier
  */
@@ -3943,6 +3839,10 @@ export type ConnectionClientSecretOidc = string;
  * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
  */
 export type ConnectionClientSecretPaypal = string;
+/**
+ * OAuth 2.0 client secret issued by the identity provider during application registration. Used to authenticate your Auth0 connection when exchanging authorization codes for tokens. May be null for public clients.
+ */
+export type ConnectionClientSecretSamlxaaRequestingApp = string;
 /**
  * The OAuth 2.0 client secret
  */
@@ -4751,6 +4651,7 @@ export interface ConnectionOptionsAuth0 extends Management.ConnectionOptionsComm
     enabledDatabaseCustomization?: Management.ConnectionEnabledDatabaseCustomization | undefined;
     import_mode?: Management.ConnectionImportMode | undefined;
     mfa?: Management.ConnectionMfa | undefined;
+    otp_settings?: Management.ConnectionOtpSettings | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
     passwordPolicy?: (Management.ConnectionPasswordPolicyEnum | null) | undefined;
     password_complexity_options?: (Management.ConnectionPasswordComplexityOptions | null) | undefined;
@@ -5655,6 +5556,8 @@ export type ConnectionOptionsProtocolEnumTwitter = (typeof ConnectionOptionsProt
  * Options for the 'samlp' connection
  */
 export interface ConnectionOptionsSaml extends Management.ConnectionOptionsCommonSaml, Management.ConnectionOptionsCommon {
+    client_id?: Management.ConnectionClientIdSamlxaaRequestingApp | undefined;
+    client_secret?: Management.ConnectionClientSecretSamlxaaRequestingApp | undefined;
     debug?: Management.ConnectionDebugSaml | undefined;
     deflate?: Management.ConnectionOptionsDeflateSaml | undefined;
     destinationUrl?: Management.ConnectionDestinationUrlSaml | undefined;
@@ -5672,6 +5575,9 @@ export interface ConnectionOptionsSaml extends Management.ConnectionOptionsCommo
     signingCert?: Management.ConnectionSigningCertSaml | undefined;
     signing_key?: Management.ConnectionSigningKeySaml | undefined;
     signOutEndpoint?: Management.ConnectionSignOutEndpointSaml | undefined;
+    token_endpoint_auth_method?: (Management.ConnectionTokenEndpointAuthMethodEnum | null) | undefined;
+    token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined;
+    token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined;
     user_id_attribute?: Management.ConnectionUserIdAttributeSaml | undefined;
     /** Accepts any additional properties */
     [key: string]: any;
@@ -5959,6 +5865,22 @@ export interface ConnectionOptionsYandex extends Management.ConnectionOptionsOAu
     /** Accepts any additional properties */
     [key: string]: any;
 }
+/**
+ * OTP settings for a delivery channel.
+ */
+export interface ConnectionOtpChannelSettings {
+    /** Number of digits in the generated one-time password. */
+    otp_length?: number | undefined;
+    /** Number of seconds before the one-time password expires. */
+    otp_expiry?: number | undefined;
+}
+/**
+ * One-time password settings, configurable per delivery channel.
+ */
+export interface ConnectionOtpSettings {
+    email?: Management.ConnectionOtpChannelSettings | undefined;
+    phone?: Management.ConnectionOtpChannelSettings | undefined;
+}
 /**
  * Passkey authentication enablement
  */
@@ -6301,8 +6223,9 @@ export interface ConnectionPropertiesOptions {
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
     /** Stores encrypted string only configurations for connections */
-    configuration?: (Record<string, string | null> | null) | undefined;
+    configuration?: (Record<string, (string | null) | undefined> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
+    otp_settings?: Management.ConnectionOtpSettings | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
     passwordPolicy?: (Management.ConnectionPasswordPolicyEnum | null) | undefined;
@@ -6948,6 +6871,7 @@ export declare namespace ConnectionResponseContentPlanningCenter {
  */
 export interface ConnectionResponseContentSaml extends Management.ConnectionPurposes, Management.ConnectionResponseCommon {
     strategy: ConnectionResponseContentSaml.Strategy;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     cross_app_access_resource_app?: (Management.ConnectionCrossAppAccessResourceApp | null) | undefined;
     options?: Management.ConnectionOptionsSaml | undefined;
     provisioning_ticket_url?: Management.ConnectionProvisioningTicketUrl | undefined;
@@ -7525,7 +7449,7 @@ export type ConnectionTokenEndpointAuthSigningAlgEnum = (typeof ConnectionTokenE
  * JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.
  */
 export type ConnectionTokenEndpointAuthSigningAlgValuesSupported = string[];
-/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
+/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the identity provider's issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
 export declare const ConnectionTokenEndpointJwtcaAudFormatEnumOidc: {
     readonly Issuer: "issuer";
     readonly TokenEndpoint: "token_endpoint";
@@ -7611,7 +7535,7 @@ export type ConnectionUpstreamAliasEnum = (typeof ConnectionUpstreamAliasEnum)[k
 /**
  * Options for adding parameters in the request to the upstream IdP
  */
-export type ConnectionUpstreamParams = (Record<string, Management.ConnectionUpstreamAdditionalProperties | null> | null) | undefined;
+export type ConnectionUpstreamParams = (Record<string, (Management.ConnectionUpstreamAdditionalProperties | null) | undefined> | null) | undefined;
 /**
  * Options for adding parameters in the request to the upstream IdP. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps
  */
@@ -7688,7 +7612,7 @@ export type ConnectionsDiscoveryUrl = (string | null) | undefined;
 /**
  * Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
  */
-export type ConnectionsMetadata = Record<string, string | null>;
+export type ConnectionsMetadata = Record<string, (string | null) | undefined>;
 /**
  * Additional OIDC metadata to include in the discovery document. Only applicable when strategy=oidc, okta, or samlp.
  */
@@ -7774,6 +7698,16 @@ export interface ConnectionsOidcMetadata {
     /** Accepts any additional properties */
     [key: string]: any;
 }
+export interface ConsentSigningKey {
+    /** The key identifier of the consent signing key. */
+    kid: string;
+    /** A human-readable label for the device holding the corresponding private key. */
+    device_identifier: string;
+    /** The ISO 8601 timestamp at which the key was registered. */
+    created_at: string;
+    /** The ISO 8601 timestamp at which the key expires and can no longer be used to verify consent decisions. */
+    expires_at: string;
+}
 /**
  * Content Security Policy configuration with multi-policy support.
  */
@@ -8022,6 +7956,7 @@ export interface CreateClientResponseContent {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -8029,6 +7964,8 @@ export interface CreateClientResponseContent {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -8555,6 +8492,7 @@ export declare namespace CreateConnectionRequestContentPlanningCenter {
  */
 export interface CreateConnectionRequestContentSaml extends Management.CreateConnectionCommon {
     strategy: CreateConnectionRequestContentSaml.Strategy;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     cross_app_access_resource_app?: (Management.ConnectionCrossAppAccessResourceApp | null) | undefined;
     options?: Management.ConnectionOptionsSaml | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
@@ -8993,6 +8931,7 @@ export interface CreateExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -9720,6 +9659,8 @@ export interface CreateResourceServerResponseContent {
     authorization_policy?: (Management.ResourceServerAuthorizationPolicy | null) | undefined;
     /** The client ID of the client that this resource server is linked to */
     client_id?: string | undefined;
+    agent_subject_claims?: Management.ResourceServerAgentSubjectClaimsResponseEnum | undefined;
+    type?: (Management.ResourceServerTypeEnum | null) | undefined;
 }
 export interface CreateRoleResponseContent {
     /** ID for this role. */
@@ -10440,7 +10381,7 @@ export type DomainCertificateStatusEnum = (typeof DomainCertificateStatusEnum)[k
 /**
  * Domain metadata associated with the custom domain, in the form of an object with string values (max 255 chars). Maximum of 10 domain metadata properties allowed.
  */
-export type DomainMetadata = Record<string, string | null>;
+export type DomainMetadata = Record<string, (string | null) | undefined>;
 /**
  * Domain verification settings.
  */
@@ -19274,6 +19215,7 @@ export interface EventStreamCloudEventContext {
     connection?: Management.EventStreamCloudEventContextConnection | undefined;
     request?: Management.EventStreamCloudEventContextRequest | undefined;
     tenant: Management.EventStreamCloudEventContextTenant;
+    transaction?: Management.EventStreamCloudEventContextTransaction | undefined;
 }
 /**
  * The OAuth Client requesting or presenting an access token.
@@ -19346,6 +19288,64 @@ export interface EventStreamCloudEventContextTenant {
     /** User-provided tenant identifier. */
     id: string;
 }
+/**
+ * An auth transaction.
+ */
+export interface EventStreamCloudEventContextTransaction {
+    /** acr_values in the request. */
+    acr_values: string[];
+    /** The locale used for this transaction. */
+    locale: string;
+    /** Hint about the login identifier the user might use in this transaction. */
+    login_hint?: string | undefined;
+    /** Instructions indicating whether the user may be prompted for re-authentication and consent. */
+    prompt?: string[] | undefined;
+    protocol?: Management.EventStreamCloudEventContextTransactionProtocolEnum | undefined;
+    /** The URL to which the client will be redirected when the transaction completes. */
+    redirect_uri?: string | undefined;
+    /** The scopes requested. */
+    requested_scopes: string[];
+    response_mode?: Management.EventStreamCloudEventContextTransactionResponseModeEnum | undefined;
+    /** The kind of credential issued by this transaction. */
+    response_type?: Management.EventStreamCloudEventContextTransactionResponseTypeItemEnum[] | undefined;
+    /** The OAuth state parameter for this transaction. */
+    state?: string | undefined;
+    /** The ui_locales requested for this transaction. */
+    ui_locales: string[];
+}
+/** The protocol used for this transaction. */
+export declare const EventStreamCloudEventContextTransactionProtocolEnum: {
+    readonly OidcBasicProfile: "oidc-basic-profile";
+    readonly OidcImplicitProfile: "oidc-implicit-profile";
+    readonly Oauth2DeviceCode: "oauth2-device-code";
+    readonly Oauth2ResourceOwner: "oauth2-resource-owner";
+    readonly Oauth2ResourceOwnerJwtBearer: "oauth2-resource-owner-jwt-bearer";
+    readonly Oauth2Password: "oauth2-password";
+    readonly Oauth2Webauthn: "oauth2-webauthn";
+    readonly Oauth2AccessToken: "oauth2-access-token";
+    readonly Oauth2RefreshToken: "oauth2-refresh-token";
+    readonly Oauth2TokenExchange: "oauth2-token-exchange";
+    readonly OidcHybridProfile: "oidc-hybrid-profile";
+    readonly Samlp: "samlp";
+    readonly Wsfed: "wsfed";
+    readonly WstrustUsernamemixed: "wstrust-usernamemixed";
+};
+export type EventStreamCloudEventContextTransactionProtocolEnum = (typeof EventStreamCloudEventContextTransactionProtocolEnum)[keyof typeof EventStreamCloudEventContextTransactionProtocolEnum];
+/** This transaction's method for returning parameters from the Authorization Endpoint. */
+export declare const EventStreamCloudEventContextTransactionResponseModeEnum: {
+    readonly Query: "query";
+    readonly Fragment: "fragment";
+    readonly FormPost: "form_post";
+    readonly WebMessage: "web_message";
+};
+export type EventStreamCloudEventContextTransactionResponseModeEnum = (typeof EventStreamCloudEventContextTransactionResponseModeEnum)[keyof typeof EventStreamCloudEventContextTransactionResponseModeEnum];
+/** OAuth/OIDC response types. */
+export declare const EventStreamCloudEventContextTransactionResponseTypeItemEnum: {
+    readonly Code: "code";
+    readonly Token: "token";
+    readonly IdToken: "id_token";
+};
+export type EventStreamCloudEventContextTransactionResponseTypeItemEnum = (typeof EventStreamCloudEventContextTransactionResponseTypeItemEnum)[keyof typeof EventStreamCloudEventContextTransactionResponseTypeItemEnum];
 /**
  * Event contents.
  */
@@ -24988,6 +24988,7 @@ export interface ExperimentListItem {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -25422,7 +25423,7 @@ export type FlowActionAuth0SendRequestParamsCustomVars = Record<string, unknown>
 export type FlowActionAuth0SendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionAuth0SendRequestParamsPayload = string | unknown[] | Management.FlowActionAuth0SendRequestParamsPayloadObject;
 export type FlowActionAuth0SendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, FlowActionAuth0SendRequestParamsQueryParams.Value | null>;
+export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, (FlowActionAuth0SendRequestParamsQueryParams.Value | null) | undefined>;
 export declare namespace FlowActionAuth0SendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -25839,7 +25840,7 @@ export interface FlowActionHttpSendRequestParamsBasicAuth {
 export type FlowActionHttpSendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionHttpSendRequestParamsPayload = string | unknown[] | Management.FlowActionHttpSendRequestParamsPayloadObject;
 export type FlowActionHttpSendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionHttpSendRequestParamsQueryParams = Record<string, FlowActionHttpSendRequestParamsQueryParams.Value | null>;
+export type FlowActionHttpSendRequestParamsQueryParams = Record<string, (FlowActionHttpSendRequestParamsQueryParams.Value | null) | undefined>;
 export declare namespace FlowActionHttpSendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -28188,9 +28189,9 @@ export interface GetBruteForceSettingsResponseContent {
     /** List of trusted IP addresses that will not have attack protection enforced against them. */
     allowlist?: string[] | undefined;
     mode?: Management.BruteForceProtectionModeEnum | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
-    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface GetClientCredentialResponseContent {
     /** ID of the credential. Generated on creation. */
@@ -28335,6 +28336,7 @@ export interface GetClientResponseContent {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -28342,6 +28344,8 @@ export interface GetClientResponseContent {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -28564,6 +28568,7 @@ export interface GetExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -29146,6 +29151,8 @@ export interface GetResourceServerResponseContent {
     authorization_policy?: (Management.ResourceServerAuthorizationPolicy | null) | undefined;
     /** The client ID of the client that this resource server is linked to */
     client_id?: string | undefined;
+    agent_subject_claims?: Management.ResourceServerAgentSubjectClaimsResponseEnum | undefined;
+    type?: (Management.ResourceServerTypeEnum | null) | undefined;
 }
 export interface GetRiskAssessmentsSettingsNewDeviceResponseContent {
     /** Length of time to remember devices for, in days. */
@@ -29625,7 +29632,7 @@ export interface GuardianFactor {
     name?: Management.GuardianFactorNameEnum | undefined;
     settings?: Management.GuardianFactorSettings | undefined;
 }
-/** Factor name. Can be `sms`, `push-notification`, `email`, `duo` `otp` `webauthn-roaming`, `webauthn-platform`, or `recovery-code`. */
+/** Factor name. Can be `sms`, `push-notification`, `email`, `duo`, `otp`, `webauthn-roaming`, `webauthn-platform`, `recovery-code`, or `passkey`. */
 export declare const GuardianFactorNameEnum: {
     readonly PushNotification: "push-notification";
     readonly Sms: "sms";
@@ -29635,6 +29642,7 @@ export declare const GuardianFactorNameEnum: {
     readonly WebauthnRoaming: "webauthn-roaming";
     readonly WebauthnPlatform: "webauthn-platform";
     readonly RecoveryCode: "recovery-code";
+    readonly Passkey: "passkey";
 };
 export type GuardianFactorNameEnum = (typeof GuardianFactorNameEnum)[keyof typeof GuardianFactorNameEnum];
 export declare const GuardianFactorPhoneFactorMessageTypeEnum: {
@@ -29991,10 +29999,6 @@ export interface ListAgentsResponseContent {
     /** A cursor to be used as the "from" query parameter for the next page of results. Omitted when there are no further results. */
     next?: string | undefined;
 }
-/**
- * List of CAPTCHA attack protection policies for the tenant, sorted by priority ascending.
- */
-export type ListAttackProtectionCaptchaPoliciesResponseContent = Management.AttackProtectionCaptchaPolicy[];
 export interface ListBrandingPhoneProvidersResponseContent {
     providers?: Management.PhoneProviderSchemaMasked[] | undefined;
 }
@@ -30234,6 +30238,9 @@ export interface ListOrganizationsPaginatedResponseContent {
 export interface ListPhoneTemplatesResponseContent {
     templates?: Management.PhoneTemplate[] | undefined;
 }
+export interface ListPortalsResponseContent {
+    portals: Management.PortalSummary[];
+}
 export interface ListRateLimitPoliciesPaginatedResponseContent {
     rate_limit_policies?: Management.RateLimitPolicy[] | undefined;
     /** A cursor to be used as the "from" query parameter for the next page of results. */
@@ -30342,6 +30349,10 @@ export interface ListUserConnectedAccountsResponseContent {
     /** The token to retrieve the next page of connected accounts (if there is one) */
     next?: string | undefined;
 }
+export interface ListUserConsentSigningKeysResponseContent {
+    /** The consent signing keys registered for the user. */
+    keys: Management.ConsentSigningKey[];
+}
 export interface ListUserEffectivePermissionRoleSourcesResponseContent {
     /** Roles with the specified permission assigned to the user, both directly and via groups. */
     roles: Management.UserEffectivePermissionRoleSourceResponseContent[];
@@ -31387,7 +31398,7 @@ export interface OrganizationMemberRole {
 /**
  * Metadata associated with the organization, in the form of an object with string values (max 255 chars). Maximum of 25 metadata properties allowed.
  */
-export type OrganizationMetadata = Record<string, string | null>;
+export type OrganizationMetadata = Record<string, (string | null) | undefined>;
 /** Field name to sort results by in ascending order only. Defaults to insertion order (oldest first) if not provided. */
 export declare const OrganizationSortFieldEnum: {
     readonly Name: "name";
@@ -31408,6 +31419,176 @@ export declare const OrganizationUsageEnum: {
     readonly Require: "require";
 };
 export type OrganizationUsageEnum = (typeof OrganizationUsageEnum)[keyof typeof OrganizationUsageEnum];
+export type PageComponent = Management.PageComponent.PageComponentAuth0Form | Management.PageComponent.PageComponentAuth0TypographyHeading | Management.PageComponent.PageComponentAuth0MediaImage | Management.PageComponent.PageComponentAuth0TypographyRichText | Management.PageComponent.PageComponentAuth0StructureSection | Management.PageComponent.PageComponentAuth0StructureSeparator | Management.PageComponent.PageComponentAuth0MyOrganizationDomainTable | Management.PageComponent.PageComponentAuth0MyOrganizationMemberManagement | Management.PageComponent.PageComponentAuth0MyOrganizationDetailsEdit | Management.PageComponent.PageComponentAuth0MyAccountPasskeyManagement | Management.PageComponent.PageComponentAuth0MyAccountMfaManagement;
+export declare namespace PageComponent {
+    interface PageComponentAuth0Form extends Management.PageComponentAuth0Form {
+        type: "page:component:auth0:form";
+    }
+    interface PageComponentAuth0TypographyHeading extends Management.PageComponentAuth0TypographyHeading {
+        type: "page:component:auth0:typography:heading";
+    }
+    interface PageComponentAuth0MediaImage extends Management.PageComponentAuth0MediaImage {
+        type: "page:component:auth0:media:image";
+    }
+    interface PageComponentAuth0TypographyRichText extends Management.PageComponentAuth0TypographyRichText {
+        type: "page:component:auth0:typography:rich_text";
+    }
+    interface PageComponentAuth0StructureSection extends Management.PageComponentAuth0StructureSection {
+        type: "page:component:auth0:structure:section";
+    }
+    interface PageComponentAuth0StructureSeparator extends Management.PageComponentAuth0StructureSeparator {
+        type: "page:component:auth0:structure:separator";
+    }
+    interface PageComponentAuth0MyOrganizationDomainTable extends Management.PageComponentAuth0MyOrganizationDomainTable {
+        type: "page:component:auth0:my_organization:domain_table";
+    }
+    interface PageComponentAuth0MyOrganizationMemberManagement extends Management.PageComponentAuth0MyOrganizationMemberManagement {
+        type: "page:component:auth0:my_organization:member_management";
+    }
+    interface PageComponentAuth0MyOrganizationDetailsEdit extends Management.PageComponentAuth0MyOrganizationDetailsEdit {
+        type: "page:component:auth0:my_organization:details_edit";
+    }
+    interface PageComponentAuth0MyAccountPasskeyManagement extends Management.PageComponentAuth0MyAccountPasskeyManagement {
+        type: "page:component:auth0:my_account:passkey_management";
+    }
+    interface PageComponentAuth0MyAccountMfaManagement extends Management.PageComponentAuth0MyAccountMfaManagement {
+        type: "page:component:auth0:my_account:mfa_management";
+    }
+}
+export interface PageComponentAuth0Form {
+    config: Management.PageComponentAuth0FormConfig;
+}
+export interface PageComponentAuth0FormConfig {
+    /** The identifier of the form you want to render. */
+    form_id: string;
+    /** Toast message displayed after successful form submission. */
+    completion_message: string;
+}
+export interface PageComponentAuth0MediaImage {
+    config: Management.PageComponentAuth0MediaImageConfig;
+}
+export interface PageComponentAuth0MediaImageConfig {
+    /** URL of the image to display. */
+    src: string;
+    position?: Management.Position | undefined;
+    /** Height of the image in pixels. Width scales automatically to preserve aspect ratio. */
+    height?: number | undefined;
+}
+/** Horizontal alignment of the image within its container. */
+export declare const Position: {
+    readonly Left: "left";
+    readonly Center: "center";
+    readonly Right: "right";
+};
+export type Position = (typeof Position)[keyof typeof Position];
+export interface PageComponentAuth0MyAccountMfaManagement {
+    config?: Management.PageComponentAuth0MyAccountMfaManagementConfig | undefined;
+}
+export interface PageComponentAuth0MyAccountMfaManagementConfig {
+}
+export interface PageComponentAuth0MyAccountPasskeyManagement {
+    config?: Management.PageComponentAuth0MyAccountPasskeyManagementConfig | undefined;
+}
+export interface PageComponentAuth0MyAccountPasskeyManagementConfig {
+}
+export interface PageComponentAuth0MyOrganizationDetailsEdit {
+    config?: Management.PageComponentAuth0MyOrganizationDetailsEditConfig | undefined;
+}
+export interface PageComponentAuth0MyOrganizationDetailsEditConfig {
+}
+export interface PageComponentAuth0MyOrganizationDomainTable {
+    config?: Management.PageComponentAuth0MyOrganizationDomainTableConfig | undefined;
+}
+export interface PageComponentAuth0MyOrganizationDomainTableConfig {
+}
+export interface PageComponentAuth0MyOrganizationMemberManagement {
+    config?: Management.PageComponentAuth0MyOrganizationMemberManagementConfig | undefined;
+}
+export interface PageComponentAuth0MyOrganizationMemberManagementConfig {
+}
+export interface PageComponentAuth0StructureSection {
+    config: Management.PageComponentAuth0StructureSectionConfig;
+}
+export interface PageComponentAuth0StructureSectionConfig {
+    /** Heading displayed at the top of the section. */
+    title?: string | undefined;
+    /** Optional description displayed below the title. */
+    description?: string | undefined;
+    variant: Management.PageComponentAuth0StructureSectionVariantEnum;
+    /** Components to render inside the section. */
+    children: Management.PageComponentNoChildren[];
+}
+/** Controls the section container style. */
+export declare const PageComponentAuth0StructureSectionVariantEnum: {
+    readonly Card: "card";
+    readonly None: "none";
+};
+export type PageComponentAuth0StructureSectionVariantEnum = (typeof PageComponentAuth0StructureSectionVariantEnum)[keyof typeof PageComponentAuth0StructureSectionVariantEnum];
+export interface PageComponentAuth0StructureSeparator {
+    config?: Management.PageComponentAuth0StructureSeparatorConfig | undefined;
+}
+export interface PageComponentAuth0StructureSeparatorConfig {
+    variant?: Management.PageComponentAuth0StructureSeparatorVariantEnum | undefined;
+    /** Optional label centered within the separator line (ignored when variant is "none"). */
+    text?: string | undefined;
+}
+/** Controls the line style. Defaults to "solid". */
+export declare const PageComponentAuth0StructureSeparatorVariantEnum: {
+    readonly Dashed: "dashed";
+    readonly None: "none";
+    readonly Solid: "solid";
+};
+export type PageComponentAuth0StructureSeparatorVariantEnum = (typeof PageComponentAuth0StructureSeparatorVariantEnum)[keyof typeof PageComponentAuth0StructureSeparatorVariantEnum];
+export interface PageComponentAuth0TypographyHeading {
+    config: Management.PageComponentAuth0TypographyHeadingConfig;
+}
+export interface PageComponentAuth0TypographyHeadingConfig {
+    /** Heading displayed. */
+    title: string;
+    /** Optional description displayed below the title. Supports basic HTML formatting: links, bold, italic, and underline. */
+    description?: string | undefined;
+}
+export interface PageComponentAuth0TypographyRichText {
+    config: Management.PageComponentAuth0TypographyRichTextConfig;
+}
+export interface PageComponentAuth0TypographyRichTextConfig {
+    /** HTML content to render. Supports headings, bold, italic, underline, links, text alignment, and lists. */
+    content: string;
+}
+export type PageComponentNoChildren = Management.PageComponentNoChildren.PageComponentAuth0Form | Management.PageComponentNoChildren.PageComponentAuth0TypographyHeading | Management.PageComponentNoChildren.PageComponentAuth0MediaImage | Management.PageComponentNoChildren.PageComponentAuth0TypographyRichText | Management.PageComponentNoChildren.PageComponentAuth0StructureSeparator | Management.PageComponentNoChildren.PageComponentAuth0MyOrganizationDomainTable | Management.PageComponentNoChildren.PageComponentAuth0MyOrganizationMemberManagement | Management.PageComponentNoChildren.PageComponentAuth0MyOrganizationDetailsEdit | Management.PageComponentNoChildren.PageComponentAuth0MyAccountPasskeyManagement | Management.PageComponentNoChildren.PageComponentAuth0MyAccountMfaManagement;
+export declare namespace PageComponentNoChildren {
+    interface PageComponentAuth0Form extends Management.PageComponentAuth0Form {
+        type: "page:component:auth0:form";
+    }
+    interface PageComponentAuth0TypographyHeading extends Management.PageComponentAuth0TypographyHeading {
+        type: "page:component:auth0:typography:heading";
+    }
+    interface PageComponentAuth0MediaImage extends Management.PageComponentAuth0MediaImage {
+        type: "page:component:auth0:media:image";
+    }
+    interface PageComponentAuth0TypographyRichText extends Management.PageComponentAuth0TypographyRichText {
+        type: "page:component:auth0:typography:rich_text";
+    }
+    interface PageComponentAuth0StructureSeparator extends Management.PageComponentAuth0StructureSeparator {
+        type: "page:component:auth0:structure:separator";
+    }
+    interface PageComponentAuth0MyOrganizationDomainTable extends Management.PageComponentAuth0MyOrganizationDomainTable {
+        type: "page:component:auth0:my_organization:domain_table";
+    }
+    interface PageComponentAuth0MyOrganizationMemberManagement extends Management.PageComponentAuth0MyOrganizationMemberManagement {
+        type: "page:component:auth0:my_organization:member_management";
+    }
+    interface PageComponentAuth0MyOrganizationDetailsEdit extends Management.PageComponentAuth0MyOrganizationDetailsEdit {
+        type: "page:component:auth0:my_organization:details_edit";
+    }
+    interface PageComponentAuth0MyAccountPasskeyManagement extends Management.PageComponentAuth0MyAccountPasskeyManagement {
+        type: "page:component:auth0:my_account:passkey_management";
+    }
+    interface PageComponentAuth0MyAccountMfaManagement extends Management.PageComponentAuth0MyAccountMfaManagement {
+        type: "page:component:auth0:my_account:mfa_management";
+    }
+}
+export type PageSlug = string;
 /** Name of the prompt. */
 export declare const PartialGroupsEnum: {
     readonly Login: "login";
@@ -31612,6 +31793,68 @@ export declare const PhoneTemplateNotificationTypeEnum: {
     readonly PasswordBreach: "password_breach";
 };
 export type PhoneTemplateNotificationTypeEnum = (typeof PhoneTemplateNotificationTypeEnum)[keyof typeof PhoneTemplateNotificationTypeEnum];
+export interface Portal {
+    id: Management.PortalId;
+    name: Management.PortalName;
+    navigation?: Management.PortalNavigation | undefined;
+    pages?: Management.PortalPagesByType | undefined;
+    slug: Management.PortalSlug;
+    client?: Management.PortalClientSecretPost | undefined;
+    custom_code?: Management.PortalCustomCode | undefined;
+    created_at: Management.PortalDateTime;
+    updated_at: Management.PortalDateTime;
+}
+export interface PortalClientSecretPost {
+    token_endpoint_auth_method: PortalClientSecretPost.TokenEndpointAuthMethod;
+    client_id: string;
+}
+export declare namespace PortalClientSecretPost {
+    const TokenEndpointAuthMethod: {
+        readonly ClientSecretPost: "client_secret_post";
+    };
+    type TokenEndpointAuthMethod = (typeof TokenEndpointAuthMethod)[keyof typeof TokenEndpointAuthMethod];
+}
+export interface PortalClientSecretPostRequest {
+    token_endpoint_auth_method: PortalClientSecretPostRequest.TokenEndpointAuthMethod;
+    client_id: string;
+    client_secret: string;
+}
+export declare namespace PortalClientSecretPostRequest {
+    const TokenEndpointAuthMethod: {
+        readonly ClientSecretPost: "client_secret_post";
+    };
+    type TokenEndpointAuthMethod = (typeof TokenEndpointAuthMethod)[keyof typeof TokenEndpointAuthMethod];
+}
+export interface PortalCustomCode {
+    /** Custom code injected into the <head> of the portal. Only injected when the portal is accessed via a custom domain; it is not injected on canonical domains. */
+    head?: string | undefined;
+}
+export type PortalCustomCodeNullable = (Management.PortalCustomCode | null) | undefined;
+export type PortalDateTime = string;
+export type PortalId = string;
+export type PortalName = string;
+export interface PortalNavigation {
+    sidebar?: Management.Sidebar | undefined;
+}
+export type PortalNavigationNullable = (Management.PortalNavigation | null) | undefined;
+export interface PortalPage {
+    title: string;
+    slug: Management.PageSlug;
+    components?: Management.PageComponent[] | undefined;
+}
+export interface PortalPagesByType {
+    default?: Management.PageSlug | undefined;
+    standard?: Management.PortalPage[] | undefined;
+}
+export type PortalPagesByTypeNullable = (Management.PortalPagesByType | null) | undefined;
+export type PortalSlug = string;
+export interface PortalSummary {
+    id: Management.PortalId;
+    name: Management.PortalName;
+    slug: Management.PortalSlug;
+    created_at: Management.PortalDateTime;
+    updated_at: Management.PortalDateTime;
+}
 export interface PostClientCredentialResponseContent {
     /** ID of the credential. Generated on creation. */
     id?: string | undefined;
@@ -32025,6 +32268,8 @@ export interface ResourceServer {
     authorization_policy?: (Management.ResourceServerAuthorizationPolicy | null) | undefined;
     /** The client ID of the client that this resource server is linked to */
     client_id?: string | undefined;
+    agent_subject_claims?: Management.ResourceServerAgentSubjectClaimsResponseEnum | undefined;
+    type?: (Management.ResourceServerTypeEnum | null) | undefined;
 }
 /**
  * Custom configuration for access tokens
@@ -32048,6 +32293,18 @@ export interface ResourceServerAccessTokenCustomClaimsMappingRule {
     /** Restricted dot-path expression read from the anonymous-session context (e.g. `anonymous_session.metadata.country`). */
     expression: string;
 }
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export declare const ResourceServerAgentSubjectClaimsResponseEnum: {
+    readonly Off: "off";
+    readonly Auth0V1: "auth0-v1";
+};
+export type ResourceServerAgentSubjectClaimsResponseEnum = (typeof ResourceServerAgentSubjectClaimsResponseEnum)[keyof typeof ResourceServerAgentSubjectClaimsResponseEnum];
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export declare const ResourceServerAgentSubjectClaimsSchemaEnum: {
+    readonly Off: "off";
+    readonly Auth0V1: "auth0-v1";
+};
+export type ResourceServerAgentSubjectClaimsSchemaEnum = (typeof ResourceServerAgentSubjectClaimsSchemaEnum)[keyof typeof ResourceServerAgentSubjectClaimsSchemaEnum];
 /**
  * Authorization policy for the resource server.
  */
@@ -32126,6 +32383,8 @@ export interface ResourceServerSearchResponse {
     authorization_policy?: (Management.ResourceServerAuthorizationPolicy | null) | undefined;
     /** The client ID of the client that this resource server is linked to */
     client_id?: string | undefined;
+    agent_subject_claims?: Management.ResourceServerAgentSubjectClaimsResponseEnum | undefined;
+    type?: (Management.ResourceServerTypeEnum | null) | undefined;
 }
 /** Field name to sort results by in ascending order only. Defaults to insertion order (oldest first) if not provided. */
 export declare const ResourceServerSortFieldEnum: {
@@ -32226,6 +32485,11 @@ export interface ResourceServerTokenEncryptionKey {
     /** PEM-formatted public key. Must be JSON escaped. */
     pem: string;
 }
+/** The type of the resource server. */
+export declare const ResourceServerTypeEnum: {
+    readonly UniversalCommerceProtocolServer: "universal_commerce_protocol_server";
+};
+export type ResourceServerTypeEnum = (typeof ResourceServerTypeEnum)[keyof typeof ResourceServerTypeEnum];
 /**
  * PEM-encoded certificate
  */
@@ -32428,6 +32692,7 @@ export interface RotateClientSecretResponseContent {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -32435,6 +32700,8 @@ export interface RotateClientSecretResponseContent {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -32754,6 +33021,7 @@ export interface SegmentRule {
 export interface SegmentStartsWithExpression {
     starts_with: string[];
 }
+/** Filter by status. Exact match. */
 export declare const SegmentStatusEnum: {
     readonly Active: "active";
     readonly Archived: "archived";
@@ -33266,6 +33534,74 @@ export type SetUserAuthenticationMethodsRequestContent = Management.SetUserAuthe
  * An object containing custom dictionaries for a group of screens.
  */
 export type SetsCustomTextsByLanguageRequestContent = Record<string, unknown>;
+export interface Sidebar {
+    components?: Management.SidebarComponent[] | undefined;
+}
+export type SidebarComponent = Management.SidebarComponent.SidebarComponentAuth0ExternalLink | Management.SidebarComponent.SidebarComponentAuth0InternalLink | Management.SidebarComponent.SidebarComponentAuth0ExternalLinkV2 | Management.SidebarComponent.SidebarComponentAuth0InternalLinkV2;
+export declare namespace SidebarComponent {
+    interface SidebarComponentAuth0ExternalLink extends Management.SidebarComponentAuth0ExternalLink {
+        type: "sidebar:component:auth0:external_link";
+    }
+    interface SidebarComponentAuth0InternalLink extends Management.SidebarComponentAuth0InternalLink {
+        type: "sidebar:component:auth0:internal_link";
+    }
+    interface SidebarComponentAuth0ExternalLinkV2 extends Management.SidebarComponentAuth0ExternalLinkV2 {
+        type: "sidebar:component:auth0:external_link:v2";
+    }
+    interface SidebarComponentAuth0InternalLinkV2 extends Management.SidebarComponentAuth0InternalLinkV2 {
+        type: "sidebar:component:auth0:internal_link:v2";
+    }
+}
+/**
+ * Deprecated. Use "sidebar:component:auth0:external_link:v2" instead.
+ */
+export interface SidebarComponentAuth0ExternalLink {
+    config: Management.SidebarComponentAuth0ExternalLinkConfig;
+}
+export interface SidebarComponentAuth0ExternalLinkConfig {
+    /** Text shown for the link. */
+    label: string;
+    /** External URL to navigate to. */
+    url: string;
+    /** Name of the icon displayed next to the link label. */
+    icon?: string | undefined;
+}
+export interface SidebarComponentAuth0ExternalLinkV2 {
+    config: Management.SidebarComponentAuth0ExternalLinkV2Config;
+}
+export interface SidebarComponentAuth0ExternalLinkV2Config {
+    /** Text shown for the link. */
+    label: string;
+    /** External URL to navigate to. */
+    href: string;
+    /** Name of the icon displayed next to the link label. */
+    icon?: string | undefined;
+}
+/**
+ * Deprecated. Use "sidebar:component:auth0:internal_link:v2" instead.
+ */
+export interface SidebarComponentAuth0InternalLink {
+    config: Management.SidebarComponentAuth0InternalLinkConfig;
+}
+export interface SidebarComponentAuth0InternalLinkConfig {
+    /** Text shown for the link. */
+    label: string;
+    /** Slug of the internal portal page to navigate to. */
+    to: string;
+    /** Name of the icon displayed next to the link label. */
+    icon?: string | undefined;
+}
+export interface SidebarComponentAuth0InternalLinkV2 {
+    config: Management.SidebarComponentAuth0InternalLinkV2Config;
+}
+export interface SidebarComponentAuth0InternalLinkV2Config {
+    /** Text shown for the link. */
+    label: string;
+    /** Slug of the internal portal page to navigate to. */
+    page_slug: string;
+    /** Name of the icon displayed next to the link label. */
+    icon?: string | undefined;
+}
 /** Algorithm used to sign JWTs. Can be `HS256` (default) or `RS256`. `PS256` available via addon. */
 export declare const SigningAlgorithmEnum: {
     readonly Hs256: "HS256";
@@ -33583,7 +33919,7 @@ export interface TenantSettingsFlags {
     revoke_refresh_token_grant?: boolean | undefined;
     /** Enables beta access to log streaming changes */
     dashboard_log_streams_next?: boolean | undefined;
-    /** Enables new insights activity page view */
+    /** Deprecated. This flag has no effect and is retained only for backward compatibility */
     dashboard_insights_view?: boolean | undefined;
     /** Disables SAML fields map fix for bad mappings with repeated attributes */
     disable_fields_map_fix?: boolean | undefined;
@@ -34063,9 +34399,9 @@ export interface UpdateBruteForceSettingsResponseContent {
     /** List of trusted IP addresses that will not have attack protection enforced against them. */
     allowlist?: string[] | undefined;
     mode?: Management.BruteForceProtectionModeEnum | undefined;
+    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
     /** Maximum number of unsuccessful attempts. */
     max_attempts?: number | undefined;
-    form_submission_mode?: Management.BruteForceProtectionFormSubmissionModeEnum | undefined;
 }
 export interface UpdateClientGrantResponseContent {
     /** ID of the client grant. */
@@ -34188,6 +34524,7 @@ export interface UpdateClientResponseContent {
     anonymous_sessions?: Management.AnonymousSessions | undefined;
     enforce_anon_session_transfer_network_binding?: Management.ClientAnonymousSessionTransferNetworkBindingEnum | undefined;
     third_party_security_mode?: Management.ClientThirdPartySecurityModeEnum | undefined;
+    oidc_support?: Management.ClientOidcSupport | undefined;
     redirection_policy?: Management.ClientRedirectionPolicyEnum | undefined;
     /** The identifier of the resource server that this client is linked to. */
     resource_server_identifier?: string | undefined;
@@ -34195,6 +34532,8 @@ export interface UpdateClientResponseContent {
     external_metadata_type?: Management.ClientExternalMetadataTypeEnum | undefined;
     external_metadata_created_by?: Management.ClientExternalMetadataCreatedByEnum | undefined;
     external_metadata_status?: Management.ClientExternalMetadataStatusEnum | undefined;
+    /** ID of the agent associated with this client. */
+    agent_id?: string | undefined;
     /** An alternate client identifier to be used during authorization flows. Only supports CIMD-based client identifiers. */
     external_client_id?: string | undefined;
     /** URL for the JSON Web Key Set (JWKS) containing the public keys used for private_key_jwt authentication. Only present for CIMD clients using private_key_jwt authentication. */
@@ -34219,8 +34558,9 @@ export interface UpdateConnectionOptions {
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
     /** Stores encrypted string only configurations for connections */
-    configuration?: (Record<string, string | null> | null) | undefined;
+    configuration?: (Record<string, (string | null) | undefined> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
+    otp_settings?: Management.ConnectionOtpSettings | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
     passwordPolicy?: (Management.ConnectionPasswordPolicyEnum | null) | undefined;
@@ -34511,6 +34851,7 @@ export interface UpdateConnectionRequestContentPlanningCenter extends Management
  */
 export interface UpdateConnectionRequestContentSaml extends Management.ConnectionCommon {
     options?: Management.ConnectionOptionsSaml | undefined;
+    cross_app_access_requesting_app?: Management.CrossAppAccessRequestingApp | undefined;
     cross_app_access_resource_app?: (Management.ConnectionCrossAppAccessResourceApp | null) | undefined;
     show_as_button?: Management.ConnectionShowAsButton | undefined;
 }
@@ -34772,6 +35113,7 @@ export interface UpdateExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -35056,6 +35398,8 @@ export interface UpdateResourceServerResponseContent {
     authorization_policy?: (Management.ResourceServerAuthorizationPolicy | null) | undefined;
     /** The client ID of the client that this resource server is linked to */
     client_id?: string | undefined;
+    agent_subject_claims?: Management.ResourceServerAgentSubjectClaimsResponseEnum | undefined;
+    type?: (Management.ResourceServerTypeEnum | null) | undefined;
 }
 export interface UpdateRiskAssessmentsSettingsNewDeviceResponseContent {
     /** Length of time to remember devices for, in days. */
@@ -35345,9 +35689,9 @@ export interface UpdateUserResponseContent {
     [key: string]: any;
 }
 /**
- * Configuration overrides for this variation; keys must exist in the parent flag parameters. Empty {} is the baseline (control) variation that overrides nothing.
+ * Top-level keys merge into the stored overrides. Set a key to `null` to remove it. Set `overrides` to `null` or `{}` to clear all. Keys must exist in the parent flag parameters.
  */
-export type UpdateVariationOverridesMap = Record<string, unknown>;
+export type UpdateVariationOverridesMap = (Record<string, unknown> | null) | undefined;
 export interface UpdateVariationResponseContent {
     id: string;
     feature_flag_id: string;