hanzoai 8.5.725 → 8.5.729

package/dist/api/iam-api.d.ts

@@ -480,6 +480,13 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     getIamOauthCallback: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -842,7 +849,7 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      */
     postIamAdminProvision: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApplication} iamApplication
      * @param {*} [options] Override http request option.
@@ -1199,7 +1206,7 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      */
     putIamAccount: (iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {string} owner
      * @param {string} name
@@ -1828,6 +1835,13 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -2190,7 +2204,7 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApplication} iamApplication
      * @param {*} [options] Override http request option.
@@ -2547,7 +2561,7 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      */
     putIamAccount(iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamAnswer>>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {string} owner
      * @param {string} name
@@ -3151,6 +3165,13 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -3487,7 +3508,7 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -3833,7 +3854,7 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      */
     putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamAnswer>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -6427,6 +6448,14 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -6807,7 +6836,7 @@ export declare class IamApi extends BaseAPI {
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -7200,7 +7229,7 @@ export declare class IamApi extends BaseAPI {
      */
     putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<IamAnswer, any, {}>>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/api/iam-api.js

@@ -1572,6 +1572,34 @@ const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys: async (options = {}) => {
+            const localVarPath = `/v1/iam/oauth/delegation/keys`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -3017,7 +3045,7 @@ const IamApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication
          * @param {*} [options] Override http request option.
@@ -4459,7 +4487,7 @@ const IamApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner
          * @param {string} name
@@ -6064,6 +6092,18 @@ const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.getIamOauthCallback']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIamOauthDelegationKeys(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIamOauthDelegationKeys(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IamApi.getIamOauthDelegationKeys']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -6646,7 +6686,7 @@ const IamApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication
          * @param {*} [options] Override http request option.
@@ -7238,7 +7278,7 @@ const IamApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner
          * @param {string} name
@@ -8063,6 +8103,15 @@ const IamApiFactory = function (configuration, basePath, axios) {
         getIamOauthCallback(options) {
             return localVarFp.getIamOauthCallback(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys(options) {
+            return localVarFp.getIamOauthDelegationKeys(options).then((request) => request(axios, basePath));
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -8487,7 +8536,7 @@ const IamApiFactory = function (configuration, basePath, axios) {
             return localVarFp.postIamAdminProvision(options).then((request) => request(axios, basePath));
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -8927,7 +8976,7 @@ const IamApiFactory = function (configuration, basePath, axios) {
             return localVarFp.putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(axios, basePath));
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -9682,6 +9731,16 @@ class IamApi extends base_1.BaseAPI {
     getIamOauthCallback(options) {
         return (0, exports.IamApiFp)(this.configuration).getIamOauthCallback(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamOauthDelegationKeys(options) {
+        return (0, exports.IamApiFp)(this.configuration).getIamOauthDelegationKeys(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -10150,7 +10209,7 @@ class IamApi extends base_1.BaseAPI {
         return (0, exports.IamApiFp)(this.configuration).postIamAdminProvision(options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -10637,7 +10696,7 @@ class IamApi extends base_1.BaseAPI {
         return (0, exports.IamApiFp)(this.configuration).putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/esm/api/iam-api.d.ts

@@ -479,6 +479,13 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     getIamOauthCallback: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -841,7 +848,7 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      */
     postIamAdminProvision: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApplication} iamApplication
      * @param {*} [options] Override http request option.
@@ -1198,7 +1205,7 @@ export declare const IamApiAxiosParamCreator: (configuration?: Configuration) =>
      */
     putIamAccount: (iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {string} owner
      * @param {string} name
@@ -1827,6 +1834,13 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -2189,7 +2203,7 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApplication} iamApplication
      * @param {*} [options] Override http request option.
@@ -2546,7 +2560,7 @@ export declare const IamApiFp: (configuration?: Configuration) => {
      */
     putIamAccount(iamAccountBody: IamAccountBody, cookie?: string, authorization?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<IamAnswer>>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {string} owner
      * @param {string} name
@@ -3150,6 +3164,13 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      * @throws {RequiredError}
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -3486,7 +3507,7 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -3832,7 +3853,7 @@ export declare const IamApiFactory: (configuration?: Configuration, basePath?: s
      */
     putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<IamAnswer>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -6426,6 +6447,14 @@ export declare class IamApi extends BaseAPI {
      * @memberof IamApi
      */
     getIamOauthCallback(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -6806,7 +6835,7 @@ export declare class IamApi extends BaseAPI {
      */
     postIamAdminProvision(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -7199,7 +7228,7 @@ export declare class IamApi extends BaseAPI {
      */
     putIamAccount(requestParameters: IamApiPutIamAccountRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<IamAnswer, any, {}>>;
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/esm/api/iam-api.js

@@ -1566,6 +1566,34 @@ export const IamApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys: async (options = {}) => {
+            const localVarPath = `/v1/iam/oauth/delegation/keys`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration);
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -3011,7 +3039,7 @@ export const IamApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication
          * @param {*} [options] Override http request option.
@@ -4453,7 +4481,7 @@ export const IamApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner
          * @param {string} name
@@ -6057,6 +6085,18 @@ export const IamApiFp = function (configuration) {
             const localVarOperationServerBasePath = operationServerMap['IamApi.getIamOauthCallback']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIamOauthDelegationKeys(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIamOauthDelegationKeys(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['IamApi.getIamOauthDelegationKeys']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -6639,7 +6679,7 @@ export const IamApiFp = function (configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication
          * @param {*} [options] Override http request option.
@@ -7231,7 +7271,7 @@ export const IamApiFp = function (configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner
          * @param {string} name
@@ -8055,6 +8095,15 @@ export const IamApiFactory = function (configuration, basePath, axios) {
         getIamOauthCallback(options) {
             return localVarFp.getIamOauthCallback(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys(options) {
+            return localVarFp.getIamOauthDelegationKeys(options).then((request) => request(axios, basePath));
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -8479,7 +8528,7 @@ export const IamApiFactory = function (configuration, basePath, axios) {
             return localVarFp.postIamAdminProvision(options).then((request) => request(axios, basePath));
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -8919,7 +8968,7 @@ export const IamApiFactory = function (configuration, basePath, axios) {
             return localVarFp.putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(axios, basePath));
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -9673,6 +9722,16 @@ export class IamApi extends BaseAPI {
     getIamOauthCallback(options) {
         return IamApiFp(this.configuration).getIamOauthCallback(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    getIamOauthDelegationKeys(options) {
+        return IamApiFp(this.configuration).getIamOauthDelegationKeys(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -10141,7 +10200,7 @@ export class IamApi extends BaseAPI {
         return IamApiFp(this.configuration).postIamAdminProvision(options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -10628,7 +10687,7 @@ export class IamApi extends BaseAPI {
         return IamApiFp(this.configuration).putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/esm/models/ai-responses-tool.d.ts

@@ -45,6 +45,12 @@ export interface AiResponsesTool {
      * @memberof AiResponsesTool
      */
     'strict'?: boolean;
+    /**
+     *
+     * @type {Array<AiResponsesTool>}
+     * @memberof AiResponsesTool
+     */
+    'tools'?: Array<AiResponsesTool>;
     /**
      *
      * @type {string}

package/dist/esm/models/iam-token.d.ts

@@ -28,7 +28,7 @@ export interface IamToken {
      */
     'accessTokenHash'?: string;
     /**
-     *
+     * Actor is the SuperAdmin (\"owner/name\") who opened this grant AS its User — impersonation, /v1/iam/impersonate — and Reason is why they said they did. Both empty on every grant a person established themselves. A grant with an Actor mints a short access token that names the actor in `act` and carries `imp`, and never a refresh token (issueTokens), and /v1/iam/signin refuses its code, so it cannot become a session at the issuer.
      * @type {string}
      * @memberof IamToken
      */

package/dist/models/ai-responses-tool.d.ts

@@ -45,6 +45,12 @@ export interface AiResponsesTool {
      * @memberof AiResponsesTool
      */
     'strict'?: boolean;
+    /**
+     *
+     * @type {Array<AiResponsesTool>}
+     * @memberof AiResponsesTool
+     */
+    'tools'?: Array<AiResponsesTool>;
     /**
      *
      * @type {string}

package/dist/models/iam-token.d.ts

@@ -28,7 +28,7 @@ export interface IamToken {
      */
     'accessTokenHash'?: string;
     /**
-     *
+     * Actor is the SuperAdmin (\"owner/name\") who opened this grant AS its User — impersonation, /v1/iam/impersonate — and Reason is why they said they did. Both empty on every grant a person established themselves. A grant with an Actor mints a short access token that names the actor in `act` and carries `imp`, and never a refresh token (issueTokens), and /v1/iam/signin refuses its code, so it cannot become a session at the issuer.
      * @type {string}
      * @memberof IamToken
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanzoai",
-  "version": "8.5.725",
+  "version": "8.5.729",
   "description": "The official TypeScript library for the Hanzo API",
   "author": "Hanzo <dev@hanzo.ai>",
   "license": "Apache-2.0",

package/src/api/iam-api.ts

@@ -2012,6 +2012,40 @@ export const IamApiAxiosParamCreator = function (configuration?: Configuration)
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/v1/iam/oauth/delegation/keys`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication bearer required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -3752,7 +3786,7 @@ export const IamApiAxiosParamCreator = function (configuration?: Configuration)
             };
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication 
          * @param {*} [options] Override http request option.
@@ -5490,7 +5524,7 @@ export const IamApiAxiosParamCreator = function (configuration?: Configuration)
             };
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner 
          * @param {string} name 
@@ -7267,6 +7301,18 @@ export const IamApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['IamApi.getIamOauthCallback']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIamOauthDelegationKeys(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['IamApi.getIamOauthDelegationKeys']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -7849,7 +7895,7 @@ export const IamApiFp = function(configuration?: Configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApplication} iamApplication 
          * @param {*} [options] Override http request option.
@@ -8441,7 +8487,7 @@ export const IamApiFp = function(configuration?: Configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {string} owner 
          * @param {string} name 
@@ -9266,6 +9312,15 @@ export const IamApiFactory = function (configuration?: Configuration, basePath?:
         getIamOauthCallback(options?: RawAxiosRequestConfig): AxiosPromise<void> {
             return localVarFp.getIamOauthCallback(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+         * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIamOauthDelegationKeys(options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.getIamOauthDelegationKeys(options).then((request) => request(axios, basePath));
+        },
         /**
          * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
          * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -9690,7 +9745,7 @@ export const IamApiFactory = function (configuration?: Configuration, basePath?:
             return localVarFp.postIamAdminProvision(options).then((request) => request(axios, basePath));
         },
         /**
-         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+         * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
          * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
          * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -10130,7 +10185,7 @@ export const IamApiFactory = function (configuration?: Configuration, basePath?:
             return localVarFp.putIamAccount(requestParameters.iamAccountBody, requestParameters.cookie, requestParameters.authorization, options).then((request) => request(axios, basePath));
         },
         /**
-         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+         * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
          * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
          * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -13122,6 +13177,17 @@ export class IamApi extends BaseAPI {
         return IamApiFp(this.configuration).getIamOauthCallback(options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with. To anyone else it answers as the token endpoint does: who are you, or not you.  The key is not a secret; publishing it is the hazard. A verifier that fetches the public JWKS and trusts what verifies would admit a delegated token as the person. So it is not in that document, and this one is not an address a relying party is ever pointed at.
+     * @summary Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IamApi
+     */
+    public getIamOauthDelegationKeys(options?: RawAxiosRequestConfig) {
+        return IamApiFp(this.configuration).getIamOauthDelegationKeys(options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Ends a sign-in and sends the browser somewhere sensible. Accepts GET or POST, so it works as a plain link.  It ACTUALLY signs you out — worth stating, because a logout that computes a redirect and answers {\"status\":\"ok\"} while ending no session and revoking no token is worse than none: the person on the shared machine believes it worked. Three things happen here, in this order:   1. The browser session dies — sid revoked server-side AND the cookie expired     (sessions.Clear). Server-side revocation is the load-bearing half: a copy     of the cookie taken before logout must not still resolve.  2. The relying party\'s tokens are revoked when an id_token_hint names it, so     the refresh token cannot mint a fresh access token after the human left.     Revocation state is authoritative — a JWT\'s `exp` still reads valid for     days, so expiry is necessary but never sufficient.  3. Only then is a redirect considered, and only to a REGISTERED uri.  The open-redirect guard: a redirect happens only when a VERIFIED id_token_hint (or client_id) identifies the application and that application has registered the target. Nobody can turn your logout link into a redirect to a site of their choosing.  A GET is the end-session navigation (OIDC RP-Initiated Logout 1.0 §2), so it always ends on a page: the registered address when one was asked for, else this issuer\'s sign-in page for the application being signed out of. A relying party therefore needs no configuration to sign someone out. A POST is also how a program signs out, so it keeps the JSON answer unless it asks for HTML.
      * @summary Ends a sign-in and sends the browser somewhere sensible.
@@ -13634,7 +13700,7 @@ export class IamApi extends BaseAPI {
     }
 
     /**
-     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
+     * Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs. A name already used in the organization is refused rather than overwritten. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is created by a SuperAdmin only.  Exported so the legacy add-application alias reuses this exact path — one create, two spellings.
      * @summary Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs.
      * @param {IamApiPostIamApplicationsRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -14168,7 +14234,7 @@ export class IamApi extends BaseAPI {
     }
 
     /**
-     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
+     * Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host. Which organization it belongs to and what it is named are fixed when it is created and are not editable here. An application that serves other organizations — isShared, or any orgChoiceMode but \"\" and \"None\" — is written by a SuperAdmin only, before and after the change.  Exported so the legacy update-application alias reuses this exact path — one update, two spellings.
      * @summary Changes an application\'s display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host.
      * @param {IamApiPutIamApplicationsByOwnerByNameRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/src/models/ai-responses-tool.ts

@@ -50,6 +50,12 @@ export interface AiResponsesTool {
      * @memberof AiResponsesTool
      */
     'strict'?: boolean;
+    /**
+     * 
+     * @type {Array<AiResponsesTool>}
+     * @memberof AiResponsesTool
+     */
+    'tools'?: Array<AiResponsesTool>;
     /**
      * 
      * @type {string}

package/src/models/iam-token.ts

@@ -33,7 +33,7 @@ export interface IamToken {
      */
     'accessTokenHash'?: string;
     /**
-     * 
+     * Actor is the SuperAdmin (\"owner/name\") who opened this grant AS its User — impersonation, /v1/iam/impersonate — and Reason is why they said they did. Both empty on every grant a person established themselves. A grant with an Actor mints a short access token that names the actor in `act` and carries `imp`, and never a refresh token (issueTokens), and /v1/iam/signin refuses its code, so it cannot become a session at the issuer.
      * @type {string}
      * @memberof IamToken
      */