hanzoai 2.2.9 → 2.2.11

package/dist/esm/api/iam-api.d.ts

@@ -12,10 +12,12 @@
 import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
+import type { IamAccountBody } from '../models';
 import type { IamAnswer } from '../models';
 import type { IamApplication } from '../models';
 import type { IamApplicationListResult } from '../models';
 import type { IamApplicationRef } from '../models';
+import type { IamAssumeBody } from '../models';
 import type { IamAuditLog } from '../models';
 import type { IamAuditlogsInput } from '../models';
 import type { IamCert } from '../models';
@@ -72,8 +74,10 @@ import type { IamRolesDeleteOutput } from '../models';
 import type { IamRolesInput } from '../models';
 import type { IamRolesListOutput } from '../models';
 import type { IamRolesRef } from '../models';
+import type { IamSearchOrganizationsOutput } from '../models';
 import type { IamSession } from '../models';
 import type { IamSessionRef } from '../models';
+import type { IamSetAvatarInput } from '../models';
 import type { IamToken } from '../models';
 import type { IamTokenKey } from '../models';
 import type { IamTokenMutation } from '../models';
@@ -650,6 +654,20 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     getIamWeb3Nonce: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+     * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSigninBegin: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+     * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSignupBegin: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
      * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -763,13 +781,13 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      */
     listTokens: (owner?: string, organization?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @param {string} [owner]
+     * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+     * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
+     * @param {string} [user]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    listWebauthnCredentials: (owner?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    listWebauthnCredentials: (user?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Applies a partial change from your identity provider — one attribute moved, not the whole record resent.  The change is applied onto the person as they currently are, so everything you did not mention keeps its value, including the parts SCIM does not describe.
      * @summary Applies a partial change from your identity provider — one attribute moved, not the whole record resent.
@@ -881,6 +899,16 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     postIamApplicationsUpdate: (iamApplication: IamApplication, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+     * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+     * @param {IamAssumeBody} iamAssumeBody
+     * @param {string} [authorization]
+     * @param {string} [xForwardedFor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamAssume: (iamAssumeBody: IamAssumeBody, authorization?: string, xForwardedFor?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
      * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -1288,6 +1316,16 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     postIamRegistryToken: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+     * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+     * @param {IamAssumeBody} iamAssumeBody
+     * @param {string} [authorization]
+     * @param {string} [xForwardedFor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamRelease: (iamAssumeBody: IamAssumeBody, authorization?: string, xForwardedFor?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
      * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -1476,6 +1514,20 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     postIamWeb3Verify: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+     * @summary Verifies the signed challenge and signs the person in.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSigninFinish: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSignupFinish: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
      * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -1508,6 +1560,16 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     postIamWorkspacesUpdate: (iamWorkspacesInput: IamWorkspacesInput, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+     * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+     * @param {IamAccountBody} iamAccountBody
+     * @param {string} [cookie]
+     * @param {string} [authorization]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    putIamAccount: (iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -1542,6 +1604,25 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     putIamScimV2UsersByOwnerByName: (owner: string, name: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+     * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+     * @param {string} [xForwardedFor]
+     * @param {string} [q]
+     * @param {number} [limit]
+     * @param {string} [cursor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    searchOrganizations: (xForwardedFor?: string, q?: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+     * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+     * @param {IamSetAvatarInput} iamSetAvatarInput
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setOrganizationAvatar: (iamSetAvatarInput: IamSetAvatarInput, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
      * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -2156,6 +2237,20 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getIamWeb3Nonce(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+     * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSigninBegin(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+     * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSignupBegin(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
      * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -2269,13 +2364,13 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      */
     listTokens(owner?: string, organization?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamListTokensOut>>;
     /**
-     * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @param {string} [owner]
+     * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+     * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
+     * @param {string} [user]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    listWebauthnCredentials(owner?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamListWebauthnCredentialsOut>>;
+    listWebauthnCredentials(user?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamListWebauthnCredentialsOut>>;
     /**
      * Applies a partial change from your identity provider — one attribute moved, not the whole record resent.  The change is applied onto the person as they currently are, so everything you did not mention keeps its value, including the parts SCIM does not describe.
      * @summary Applies a partial change from your identity provider — one attribute moved, not the whole record resent.
@@ -2387,6 +2482,16 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     postIamApplicationsUpdate(iamApplication: IamApplication, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamApplication>>;
+    /**
+     * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+     * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+     * @param {IamAssumeBody} iamAssumeBody
+     * @param {string} [authorization]
+     * @param {string} [xForwardedFor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamAssume(iamAssumeBody: IamAssumeBody, authorization?: string, xForwardedFor?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamAnswer>>;
     /**
      * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
      * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -2794,6 +2899,16 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     postIamRegistryToken(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+     * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+     * @param {IamAssumeBody} iamAssumeBody
+     * @param {string} [authorization]
+     * @param {string} [xForwardedFor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamRelease(iamAssumeBody: IamAssumeBody, authorization?: string, xForwardedFor?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamAnswer>>;
     /**
      * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
      * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -2982,6 +3097,20 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     postIamWeb3Verify(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+     * @summary Verifies the signed challenge and signs the person in.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSigninFinish(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSignupFinish(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
      * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -3014,6 +3143,16 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     postIamWorkspacesUpdate(iamWorkspacesInput: IamWorkspacesInput, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamWorkspace>>;
+    /**
+     * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+     * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+     * @param {IamAccountBody} iamAccountBody
+     * @param {string} [cookie]
+     * @param {string} [authorization]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    putIamAccount(iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamAnswer>>;
     /**
      * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -3048,6 +3187,25 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     putIamScimV2UsersByOwnerByName(owner: string, name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+     * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+     * @param {string} [xForwardedFor]
+     * @param {string} [q]
+     * @param {number} [limit]
+     * @param {string} [cursor]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    searchOrganizations(xForwardedFor?: string, q?: string, limit?: number, cursor?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamSearchOrganizationsOutput>>;
+    /**
+     * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+     * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+     * @param {IamSetAvatarInput} iamSetAvatarInput
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setOrganizationAvatar(iamSetAvatarInput: IamSetAvatarInput, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamOrganization>>;
     /**
      * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
      * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -3645,6 +3803,20 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     getIamWeb3Nonce(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+     * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSigninBegin(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+     * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamWebauthnSignupBegin(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
      * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -3754,8 +3926,8 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      */
     listTokens(requestParameters?: IamApiListTokensRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamListTokensOut>;
     /**
-     * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
+     * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+     * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
      * @param {IamApiListWebauthnCredentialsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -3871,6 +4043,14 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     postIamApplicationsUpdate(requestParameters: IamApiPostIamApplicationsUpdateRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamApplication>;
+    /**
+     * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+     * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+     * @param {IamApiPostIamAssumeRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamAssume(requestParameters: IamApiPostIamAssumeRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamAnswer>;
     /**
      * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
      * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -4278,6 +4458,14 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     postIamRegistryToken(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+     * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+     * @param {IamApiPostIamReleaseRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamRelease(requestParameters: IamApiPostIamReleaseRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamAnswer>;
     /**
      * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
      * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -4466,6 +4654,20 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     postIamWeb3Verify(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+     * @summary Verifies the signed challenge and signs the person in.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSigninFinish(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postIamWebauthnSignupFinish(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
      * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -4498,6 +4700,14 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     postIamWorkspacesUpdate(requestParameters: IamApiPostIamWorkspacesUpdateRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamWorkspace>;
+    /**
+     * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+     * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+     * @param {IamApiPutIamAccountRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamAnswer>;
     /**
      * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -4529,6 +4739,22 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     putIamScimV2UsersByOwnerByName(requestParameters: IamApiPutIamScimV2UsersByOwnerByNameRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+     * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+     * @param {IamApiSearchOrganizationsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    searchOrganizations(requestParameters?: IamApiSearchOrganizationsRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamSearchOrganizationsOutput>;
+    /**
+     * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+     * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+     * @param {IamApiSetOrganizationAvatarRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setOrganizationAvatar(requestParameters: IamApiSetOrganizationAvatarRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamOrganization>;
     /**
      * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
      * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.
@@ -5321,7 +5547,7 @@ export interface IamApiListWebauthnCredentialsRequest {
      * @type {string}
      * @memberof IamApiListWebauthnCredentials
      */
-    readonly owner?: string;
+    readonly user?: string;
 }
 /**
  * Request parameters for patchIamScimV2UsersByOwnerByName operation in IamApi.
@@ -5485,6 +5711,31 @@ export interface IamApiPostIamApplicationsUpdateRequest {
      */
     readonly iamApplication: IamApplication;
 }
+/**
+ * Request parameters for postIamAssume operation in IamApi.
+ * @export
+ * @interface IamApiPostIamAssumeRequest
+ */
+export interface IamApiPostIamAssumeRequest {
+    /**
+     *
+     * @type {IamAssumeBody}
+     * @memberof IamApiPostIamAssume
+     */
+    readonly iamAssumeBody: IamAssumeBody;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPostIamAssume
+     */
+    readonly authorization?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPostIamAssume
+     */
+    readonly xForwardedFor?: string;
+}
 /**
  * Request parameters for postIamAuditLogs operation in IamApi.
  * @export
@@ -5862,6 +6113,31 @@ export interface IamApiPostIamProjectsUpdateRequest {
      */
     readonly iamInput: IamInput;
 }
+/**
+ * Request parameters for postIamRelease operation in IamApi.
+ * @export
+ * @interface IamApiPostIamReleaseRequest
+ */
+export interface IamApiPostIamReleaseRequest {
+    /**
+     *
+     * @type {IamAssumeBody}
+     * @memberof IamApiPostIamRelease
+     */
+    readonly iamAssumeBody: IamAssumeBody;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPostIamRelease
+     */
+    readonly authorization?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPostIamRelease
+     */
+    readonly xForwardedFor?: string;
+}
 /**
  * Request parameters for postIamRoles operation in IamApi.
  * @export
@@ -6083,6 +6359,31 @@ export interface IamApiPostIamWorkspacesUpdateRequest {
      */
     readonly iamWorkspacesInput: IamWorkspacesInput;
 }
+/**
+ * Request parameters for putIamAccount operation in IamApi.
+ * @export
+ * @interface IamApiPutIamAccountRequest
+ */
+export interface IamApiPutIamAccountRequest {
+    /**
+     *
+     * @type {IamAccountBody}
+     * @memberof IamApiPutIamAccount
+     */
+    readonly iamAccountBody: IamAccountBody;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPutIamAccount
+     */
+    readonly cookie?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiPutIamAccount
+     */
+    readonly authorization?: string;
+}
 /**
  * Request parameters for putIamApplication operation in IamApi.
  * @export
@@ -6140,6 +6441,50 @@ export interface IamApiPutIamScimV2UsersByOwnerByNameRequest {
      */
     readonly name: string;
 }
+/**
+ * Request parameters for searchOrganizations operation in IamApi.
+ * @export
+ * @interface IamApiSearchOrganizationsRequest
+ */
+export interface IamApiSearchOrganizationsRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiSearchOrganizations
+     */
+    readonly xForwardedFor?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiSearchOrganizations
+     */
+    readonly q?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof IamApiSearchOrganizations
+     */
+    readonly limit?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof IamApiSearchOrganizations
+     */
+    readonly cursor?: string;
+}
+/**
+ * Request parameters for setOrganizationAvatar operation in IamApi.
+ * @export
+ * @interface IamApiSetOrganizationAvatarRequest
+ */
+export interface IamApiSetOrganizationAvatarRequest {
+    /**
+     *
+     * @type {IamSetAvatarInput}
+     * @memberof IamApiSetOrganizationAvatar
+     */
+    readonly iamSetAvatarInput: IamSetAvatarInput;
+}
 /**
  * Request parameters for updateOrganization operation in IamApi.
  * @export
@@ -6854,6 +7199,22 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     getIamWeb3Nonce(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.  The account is named in the query, and the challenge is bound to it, so what may answer is decided here — by the server, from the row — and the finish checks the answer against that decision rather than recomputing it.
+     * @summary Starts a passkey sign-in: it returns the challenge the person\'s authenticator signs.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamWebauthnSigninBegin(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.  Passkeys already on the account are EXCLUDED, so a second enrollment on a device that already holds one is refused by the authenticator itself rather than silently producing a duplicate the person cannot tell apart.
+     * @summary Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamWebauthnSignupBegin(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.  Keys appear here before they start signing and stay after they stop, so a rotation never leaves a live token unverifiable. Nothing private is ever published.
      * @summary Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours.
@@ -6977,8 +7338,8 @@ export declare class IamApi extends BaseAPI {
      */
     listTokens(requestParameters?: IamApiListTokensRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamListTokensOut, any, {}>>;
     /**
-     * Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
-     * @summary Returns the passkeys and security keys registered in your organization, newest first — which device each belongs to and when it was last used.
+     * Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.  Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.  There is no organization-wide list. It used to scope to the ORG, which handed an org admin every member\'s credential rows in one answer, and a SuperAdmin every tenant\'s; a plain member meanwhile could not read even their own, because an unnamed target fails the Guard\'s tenant rule. One scope fixes both halves: the answer is a person\'s, and the caller is the person unless they say otherwise and may.
+     * @summary Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
      * @param {IamApiListWebauthnCredentialsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -7109,6 +7470,15 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     postIamApplicationsUpdate(requestParameters: IamApiPostIamApplicationsUpdateRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamApplication, any, {}>>;
+    /**
+     * Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.  The token still names the operator — stepping in is not becoming somebody else — and records the organization it was scoped to, so everything done with it is attributed to the person who did it. Only a platform operator may, and the attempt is recorded whether or not it succeeds.
+     * @summary Steps a platform operator into an organization: it returns their own access token re-scoped to that tenant, so they see what the tenant sees.
+     * @param {IamApiPostIamAssumeRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamAssume(requestParameters: IamApiPostIamAssumeRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamAnswer, any, {}>>;
     /**
      * Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
      * @summary Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you.
@@ -7570,6 +7940,15 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     postIamRegistryToken(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in. Recorded like the step in.
+     * @summary Steps a platform operator back out: it returns their own access token with no organization assumed, which is the credential they had before they stepped in.
+     * @param {IamApiPostIamReleaseRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamRelease(requestParameters: IamApiPostIamReleaseRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamAnswer, any, {}>>;
     /**
      * Clears the target user\'s key of the requested TYPE (immediate revoke). Scoped by the same `?type` field mint takes, so revoking the browser key leaves the server key working. A secret key\'s stored value is the sk- in its schema.Key row.
      * @summary Clears the target user\'s key of the requested TYPE (immediate revoke).
@@ -7783,6 +8162,22 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     postIamWeb3Verify(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Verifies the signed challenge and signs the person in.  It answers exactly as a password sign-in does — the same envelope, through the same grant — so nothing downstream branches on how somebody arrived.
+     * @summary Verifies the signed challenge and signs the person in.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamWebauthnSigninFinish(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @summary Verifies the newly created passkey and stores it, so the person can sign in with their device from then on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    postIamWebauthnSignupFinish(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them. A name already used in the organization is refused.
      * @summary Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them.
@@ -7819,6 +8214,15 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     postIamWorkspacesUpdate(requestParameters: IamApiPostIamWorkspacesUpdateRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamWorkspace, any, {}>>;
+    /**
+     * Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.  Only their own: the request names nobody, so it cannot reach another account. Send only what you are changing; a field you leave out keeps the value it had, and a field you send empty is cleared.  A picture is an https link or an inline image up to 96 KiB, the same value an organization\'s mark is (schema.AvatarRef) — one rule for how a subject appears, whether the subject is a person or an organization.
+     * @summary Saves the calling person\'s own profile — the name they are shown by, their picture, a line about themselves and a link.
+     * @param {IamApiPutIamAccountRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamAnswer, any, {}>>;
     /**
      * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
@@ -7854,6 +8258,24 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     putIamScimV2UsersByOwnerByName(requestParameters: IamApiPutIamScimV2UsersByOwnerByNameRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.  Platform operators see every organization; everyone else sees their own. Pass the cursor from the previous page to continue; an empty cursor in the answer means there is nothing more.
+     * @summary Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name.
+     * @param {IamApiSearchOrganizationsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    searchOrganizations(requestParameters?: IamApiSearchOrganizationsRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamSearchOrganizationsOutput, any, {}>>;
+    /**
+     * Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji. Sending an image clears the emoji and sending an emoji clears the image — an organization has one mark, not a preference order — and sending neither clears both, which is how it goes back to being drawn as its initial.  An image is an https link or the bytes inline as a data URL, up to 96 KiB. Anyone who administers the organization may set this; it is not reserved to the platform.  It writes the two fields onto the stored row and touches nothing else, which update cannot do: update replaces the whole record, and a record read back first arrives masked, so a read-modify-write through it would persist the mask over the organization\'s own credential settings.
+     * @summary Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji.
+     * @param {IamApiSetOrganizationAvatarRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    setOrganizationAvatar(requestParameters: IamApiSetOrganizationAvatarRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamOrganization, any, {}>>;
     /**
      * Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits. Which organization it is does not change, and neither does when it was created.
      * @summary Changes an organization\'s display, its defaults and the sign-in rules everyone in it inherits.