hanzoai 2.2.10 → 8.5.89

package/dist/api/iam-api.js

@@ -2257,6 +2257,62 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+         * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamWebauthnSigninBegin: async (options = {}) => {
+            const localVarPath = `/v1/iam/webauthn/signin/begin`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+         * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamWebauthnSignupBegin: async (options = {}) => {
+            const localVarPath = `/v1/iam/webauthn/signup/begin`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
          * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -2711,13 +2767,13 @@ const IamApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-         * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-         * @param {string} [owner]
+         * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+         * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
+         * @param {string} [user]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listWebauthnCredentials: async (owner, options = {}) => {
+        listWebauthnCredentials: async (user, options = {}) => {
             const localVarPath = `/v1/iam/webauthn-credentials`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
@@ -2731,8 +2787,8 @@ const IamApiAxiosParamCreator = function (configuration) {
             // authentication bearer required
             // http bearer authentication required
             await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            if (owner !== undefined) {
-                localVarQueryParameter['owner'] = owner;
+            if (user !== undefined) {
+                localVarQueryParameter['user'] = user;
             }
             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
@@ -3197,6 +3253,47 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+         * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+         * @param {IamAssumeBody} iamAssumeBody
+         * @param {string} [authorization]
+         * @param {string} [xForwardedFor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamAssume: async (iamAssumeBody, authorization, xForwardedFor, options = {}) => {
+            // verify required parameter 'iamAssumeBody' is not null or undefined
+            (0, common_1.assertParamExists)('postIamAssume', 'iamAssumeBody', iamAssumeBody);
+            const localVarPath = `/v1/iam/assume`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            if (authorization != null) {
+                localVarHeaderParameter['Authorization'] = String(authorization);
+            }
+            if (xForwardedFor != null) {
+                localVarHeaderParameter['X-Forwarded-For'] = String(xForwardedFor);
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(iamAssumeBody, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
          * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -4854,6 +4951,47 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+         * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+         * @param {IamAssumeBody} iamAssumeBody
+         * @param {string} [authorization]
+         * @param {string} [xForwardedFor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamRelease: async (iamAssumeBody, authorization, xForwardedFor, options = {}) => {
+            // verify required parameter 'iamAssumeBody' is not null or undefined
+            (0, common_1.assertParamExists)('postIamRelease', 'iamAssumeBody', iamAssumeBody);
+            const localVarPath = `/v1/iam/release`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            if (authorization != null) {
+                localVarHeaderParameter['Authorization'] = String(authorization);
+            }
+            if (xForwardedFor != null) {
+                localVarHeaderParameter['X-Forwarded-For'] = String(xForwardedFor);
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(iamAssumeBody, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
          * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -5618,6 +5756,62 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+         * @summary Verifies the signed challenge and signs the person in.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamWebauthnSigninFinish: async (options = {}) => {
+            const localVarPath = `/v1/iam/webauthn/signin/finish`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamWebauthnSignupFinish: async (options = {}) => {
+            const localVarPath = `/v1/iam/webauthn/signup/finish`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
          * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -5750,6 +5944,47 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+         * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+         * @param {IamAccountBody} iamAccountBody
+         * @param {string} [cookie]
+         * @param {string} [authorization]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        putIamAccount: async (iamAccountBody, cookie, authorization, options = {}) => {
+            // verify required parameter 'iamAccountBody' is not null or undefined
+            (0, common_1.assertParamExists)('putIamAccount', 'iamAccountBody', iamAccountBody);
+            const localVarPath = `/v1/iam/account`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            if (cookie != null) {
+                localVarHeaderParameter['Cookie'] = String(cookie);
+            }
+            if (authorization != null) {
+                localVarHeaderParameter['Authorization'] = String(authorization);
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(iamAccountBody, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -5888,6 +6123,83 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+         * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+         * @param {string} [xForwardedFor]
+         * @param {string} [q]
+         * @param {number} [limit]
+         * @param {string} [cursor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        searchOrganizations: async (xForwardedFor, q, limit, cursor, options = {}) => {
+            const localVarPath = `/v1/iam/organizations/search`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            if (q !== undefined) {
+                localVarQueryParameter['q'] = q;
+            }
+            if (limit !== undefined) {
+                localVarQueryParameter['limit'] = limit;
+            }
+            if (cursor !== undefined) {
+                localVarQueryParameter['cursor'] = cursor;
+            }
+            if (xForwardedFor != null) {
+                localVarHeaderParameter['X-Forwarded-For'] = String(xForwardedFor);
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+         * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+         * @param {IamSetAvatarInput} iamSetAvatarInput
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        setOrganizationAvatar: async (iamSetAvatarInput, options = {}) => {
+            // verify required parameter 'iamSetAvatarInput' is not null or undefined
+            (0, common_1.assertParamExists)('setOrganizationAvatar', 'iamSetAvatarInput', iamSetAvatarInput);
+            const localVarPath = `/v1/iam/organizations/avatar`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(iamSetAvatarInput, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
          * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -7042,6 +7354,30 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.getIamWeb3Nonce']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+         * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIamWebauthnSigninBegin(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIamWebauthnSigninBegin(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.getIamWebauthnSigninBegin']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+         * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIamWebauthnSignupBegin(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIamWebauthnSignupBegin(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.getIamWebauthnSignupBegin']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
          * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -7225,14 +7561,14 @@ const IamApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-         * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-         * @param {string} [owner]
+         * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+         * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
+         * @param {string} [user]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        async listWebauthnCredentials(owner, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.listWebauthnCredentials(owner, options);
+        async listWebauthnCredentials(user, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listWebauthnCredentials(user, options);
             const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.listWebauthnCredentials']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -7418,6 +7754,21 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamApplicationsUpdate']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+         * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+         * @param {IamAssumeBody} iamAssumeBody
+         * @param {string} [authorization]
+         * @param {string} [xForwardedFor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postIamAssume(iamAssumeBody, authorization, xForwardedFor, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postIamAssume(iamAssumeBody, authorization, xForwardedFor, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamAssume']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
          * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -8095,6 +8446,21 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamRegistryToken']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+         * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+         * @param {IamAssumeBody} iamAssumeBody
+         * @param {string} [authorization]
+         * @param {string} [xForwardedFor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postIamRelease(iamAssumeBody, authorization, xForwardedFor, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postIamRelease(iamAssumeBody, authorization, xForwardedFor, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamRelease']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
          * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -8408,6 +8774,30 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamWeb3Verify']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+         * @summary Verifies the signed challenge and signs the person in.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postIamWebauthnSigninFinish(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postIamWebauthnSigninFinish(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamWebauthnSigninFinish']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postIamWebauthnSignupFinish(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postIamWebauthnSignupFinish(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamWebauthnSignupFinish']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
          * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -8460,6 +8850,21 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.postIamWorkspacesUpdate']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+         * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+         * @param {IamAccountBody} iamAccountBody
+         * @param {string} [cookie]
+         * @param {string} [authorization]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async putIamAccount(iamAccountBody, cookie, authorization, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.putIamAccount(iamAccountBody, cookie, authorization, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.putIamAccount']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -8514,6 +8919,35 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.putIamScimV2UsersByOwnerByName']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+         * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+         * @param {string} [xForwardedFor]
+         * @param {string} [q]
+         * @param {number} [limit]
+         * @param {string} [cursor]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async searchOrganizations(xForwardedFor, q, limit, cursor, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.searchOrganizations(xForwardedFor, q, limit, cursor, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.searchOrganizations']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+         * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+         * @param {IamSetAvatarInput} iamSetAvatarInput
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async setOrganizationAvatar(iamSetAvatarInput, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.setOrganizationAvatar(iamSetAvatarInput, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.setOrganizationAvatar']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
          * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -9292,6 +9726,24 @@ const IamApiFactory = function (configuration, basePath, axios) {
         getIamWeb3Nonce(options) {
             return localVarFp.getIamWeb3Nonce(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+         * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamWebauthnSigninBegin(options) {
+            return localVarFp.getIamWebauthnSigninBegin(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+         * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamWebauthnSignupBegin(options) {
+            return localVarFp.getIamWebauthnSignupBegin(options).then((request) => request(axios, basePath));
+        },
         /**
          * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
          * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -9429,14 +9881,14 @@ const IamApiFactory = function (configuration, basePath, axios) {
             return localVarFp.listTokens(requestParameters.owner, requestParameters.organization, options).then((request) => request(axios, basePath));
         },
         /**
-         * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-         * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
+         * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+         * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
          * @param {IamApiListWebauthnCredentialsRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
         listWebauthnCredentials(requestParameters = {}, options) {
-            return localVarFp.listWebauthnCredentials(requestParameters.owner, options).then((request) => request(axios, basePath));
+            return localVarFp.listWebauthnCredentials(requestParameters.user, options).then((request) => request(axios, basePath));
         },
         /**
          * Applies a partial change from your identity provider — one attribute moved, not the whole record resent.  The change is applied onto the person as they currently are, so everything you did not mention keeps its value, including the parts SCIM does not describe.
@@ -9576,6 +10028,16 @@ const IamApiFactory = function (configuration, basePath, axios) {
         postIamApplicationsUpdate(requestParameters, options) {
             return localVarFp.postIamApplicationsUpdate(requestParameters.iamApplication, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+         * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+         * @param {IamApiPostIamAssumeRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamAssume(requestParameters, options) {
+            return localVarFp.postIamAssume(requestParameters.iamAssumeBody, requestParameters.authorization, requestParameters.xForwardedFor, options).then((request) => request(axios, basePath));
+        },
         /**
          * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
          * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -10091,6 +10553,16 @@ const IamApiFactory = function (configuration, basePath, axios) {
         postIamRegistryToken(options) {
             return localVarFp.postIamRegistryToken(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+         * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+         * @param {IamApiPostIamReleaseRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamRelease(requestParameters, options) {
+            return localVarFp.postIamRelease(requestParameters.iamAssumeBody, requestParameters.authorization, requestParameters.xForwardedFor, options).then((request) => request(axios, basePath));
+        },
         /**
          * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
          * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -10329,6 +10801,24 @@ const IamApiFactory = function (configuration, basePath, axios) {
         postIamWeb3Verify(options) {
             return localVarFp.postIamWeb3Verify(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+         * @summary Verifies the signed challenge and signs the person in.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamWebauthnSigninFinish(options) {
+            return localVarFp.postIamWebauthnSigninFinish(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postIamWebauthnSignupFinish(options) {
+            return localVarFp.postIamWebauthnSignupFinish(options).then((request) => request(axios, basePath));
+        },
         /**
          * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
          * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -10369,6 +10859,16 @@ const IamApiFactory = function (configuration, basePath, axios) {
         postIamWorkspacesUpdate(requestParameters, options) {
             return localVarFp.postIamWorkspacesUpdate(requestParameters.iamWorkspacesInput, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+         * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+         * @param {IamApiPutIamAccountRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        putIamAccount(requestParameters, options) {
+            return localVarFp.putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(axios, basePath));
+        },
         /**
          * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -10408,6 +10908,26 @@ const IamApiFactory = function (configuration, basePath, axios) {
         putIamScimV2UsersByOwnerByName(requestParameters, options) {
             return localVarFp.putIamScimV2UsersByOwnerByName(requestParameters.owner, requestParameters.name, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+         * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+         * @param {IamApiSearchOrganizationsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        searchOrganizations(requestParameters = {}, options) {
+            return localVarFp.searchOrganizations(requestParameters.xForwardedFor, requestParameters.q, requestParameters.limit, requestParameters.cursor, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+         * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+         * @param {IamApiSetOrganizationAvatarRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        setOrganizationAvatar(requestParameters, options) {
+            return localVarFp.setOrganizationAvatar(requestParameters.iamSetAvatarInput, options).then((request) => request(axios, basePath));
+        },
         /**
          * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
          * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -11234,6 +11754,26 @@ class IamApi extends base_1.BaseAPI {
     getIamWeb3Nonce(options) {
         return (0, exports.IamApiFp)(this.configuration).getIamWeb3Nonce(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+     * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamWebauthnSigninBegin(options) {
+        return (0, exports.IamApiFp)(this.configuration).getIamWebauthnSigninBegin(options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+     * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamWebauthnSignupBegin(options) {
+        return (0, exports.IamApiFp)(this.configuration).getIamWebauthnSignupBegin(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
      * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -11385,15 +11925,15 @@ class IamApi extends base_1.BaseAPI {
         return (0, exports.IamApiFp)(this.configuration).listTokens(requestParameters.owner, requestParameters.organization, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
+     * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+     * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
      * @param {IamApiListWebauthnCredentialsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof IamApi
      */
     listWebauthnCredentials(requestParameters = {}, options) {
-        return (0, exports.IamApiFp)(this.configuration).listWebauthnCredentials(requestParameters.owner, options).then((request) => request(this.axios, this.basePath));
+        return (0, exports.IamApiFp)(this.configuration).listWebauthnCredentials(requestParameters.user, options).then((request) => request(this.axios, this.basePath));
     }
     /**
      * Applies a partial change from your identity provider — one attribute moved, not the whole record resent.  The change is applied onto the person as they currently are, so everything you did not mention keeps its value, including the parts SCIM does not describe.
@@ -11547,6 +12087,17 @@ class IamApi extends base_1.BaseAPI {
     postIamApplicationsUpdate(requestParameters, options) {
         return (0, exports.IamApiFp)(this.configuration).postIamApplicationsUpdate(requestParameters.iamApplication, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+     * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+     * @param {IamApiPostIamAssumeRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamAssume(requestParameters, options) {
+        return (0, exports.IamApiFp)(this.configuration).postIamAssume(requestParameters.iamAssumeBody, requestParameters.authorization, requestParameters.xForwardedFor, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
      * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -12116,6 +12667,17 @@ class IamApi extends base_1.BaseAPI {
     postIamRegistryToken(options) {
         return (0, exports.IamApiFp)(this.configuration).postIamRegistryToken(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+     * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+     * @param {IamApiPostIamReleaseRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamRelease(requestParameters, options) {
+        return (0, exports.IamApiFp)(this.configuration).postIamRelease(requestParameters.iamAssumeBody, requestParameters.authorization, requestParameters.xForwardedFor, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
      * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -12379,6 +12941,26 @@ class IamApi extends base_1.BaseAPI {
     postIamWeb3Verify(options) {
         return (0, exports.IamApiFp)(this.configuration).postIamWeb3Verify(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+     * @summary Verifies the signed challenge and signs the person in.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamWebauthnSigninFinish(options) {
+        return (0, exports.IamApiFp)(this.configuration).postIamWebauthnSigninFinish(options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamWebauthnSignupFinish(options) {
+        return (0, exports.IamApiFp)(this.configuration).postIamWebauthnSignupFinish(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
      * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -12423,6 +13005,17 @@ class IamApi extends base_1.BaseAPI {
     postIamWorkspacesUpdate(requestParameters, options) {
         return (0, exports.IamApiFp)(this.configuration).postIamWorkspacesUpdate(requestParameters.iamWorkspacesInput, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+     * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+     * @param {IamApiPutIamAccountRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    putIamAccount(requestParameters, options) {
+        return (0, exports.IamApiFp)(this.configuration).putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -12466,6 +13059,28 @@ class IamApi extends base_1.BaseAPI {
     putIamScimV2UsersByOwnerByName(requestParameters, options) {
         return (0, exports.IamApiFp)(this.configuration).putIamScimV2UsersByOwnerByName(requestParameters.owner, requestParameters.name, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+     * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+     * @param {IamApiSearchOrganizationsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    searchOrganizations(requestParameters = {}, options) {
+        return (0, exports.IamApiFp)(this.configuration).searchOrganizations(requestParameters.xForwardedFor, requestParameters.q, requestParameters.limit, requestParameters.cursor, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+     * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+     * @param {IamApiSetOrganizationAvatarRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    setOrganizationAvatar(requestParameters, options) {
+        return (0, exports.IamApiFp)(this.configuration).setOrganizationAvatar(requestParameters.iamSetAvatarInput, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
      * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.