humanos 1.0.5 → 1.0.6

package/dist/index.js

@@ -62,6 +62,7 @@ __export(index_exports, {
   DIDApiFp: () => DIDApiFp,
   DeliveryActionType: () => DeliveryActionType,
   GenerateRequestDtoSecurityLevelEnum: () => GenerateRequestDtoSecurityLevelEnum,
+  GenerateRequestUserDtoLanguageEnum: () => GenerateRequestUserDtoLanguageEnum,
   HumanosClient: () => HumanosClient,
   IdentityEventEventTypeEnum: () => IdentityEventEventTypeEnum,
   ListSecurityLevelEnum: () => ListSecurityLevelEnum,
@@ -773,7 +774,6 @@ var ListTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 var WorkflowsTypesEnum = {
@@ -781,7 +781,6 @@ var WorkflowsTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -917,7 +916,7 @@ var CredentialsApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1012,7 +1011,7 @@ var CredentialsApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, import_axios5.default, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1077,7 +1076,7 @@ var CredentialsApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.revoke(credentialId, aPIVersion, revokeCredentialDto, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1141,7 +1140,7 @@ var CredentialsApi = class extends BaseAPI {
     return CredentialsApiFp(this.configuration).revoke(credentialId, aPIVersion, revokeCredentialDto, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+   * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
    * @summary Verify VP
    * @param {VerifyPresentationDto} verifyPresentationDto 
    * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1401,7 +1400,7 @@ var RequestsApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1516,7 +1515,7 @@ var RequestsApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, import_axios7.default, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1591,7 +1590,7 @@ var RequestsApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.list(pageIndex, pageSize, search, dateFrom, dateTo, subject, internalId, securityLevel, aPIVersion, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1665,7 +1664,7 @@ var RequestsApi = class extends BaseAPI {
     return RequestsApiFp(this.configuration).list(pageIndex, pageSize, search, dateFrom, dateTo, subject, internalId, securityLevel, aPIVersion, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+   * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
    * @summary Resend OTP
    * @param {string} requestId Unique identifier of the  request.
    * @param {string} [contact] Verified contact value (email or phone)
@@ -1935,7 +1934,7 @@ var WebhooksApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2032,7 +2031,7 @@ var WebhooksApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, import_axios9.default, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2087,7 +2086,7 @@ var WebhooksApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.identity(identityEvent, aPIVersion, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2136,7 +2135,7 @@ var WebhooksApi = class extends BaseAPI {
     return WebhooksApiFp(this.configuration).identity(identityEvent, aPIVersion, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+   * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
    * @summary OTP Failed Event
    * @param {OtpFailedEvent} otpFailedEvent 
    * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2291,6 +2290,14 @@ var GenerateRequestDtoSecurityLevelEnum = {
   HumanosRevalidation: "HUMANOS_REVALIDATION"
 };
 
+// generated/models/generate-request-user-dto.ts
+var GenerateRequestUserDtoLanguageEnum = {
+  Eng: "ENG",
+  Prt: "PRT",
+  Spa: "SPA",
+  Fra: "FRA"
+};
+
 // generated/models/identity-event.ts
 var IdentityEventEventTypeEnum = {
   Identity: "identity"
@@ -2355,7 +2362,6 @@ var ResourceEntityTypeEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2365,7 +2371,6 @@ var ResourceMinimalEntityTypeEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2375,7 +2380,6 @@ var ResourceQueryTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2452,7 +2456,7 @@ function applySignatureInterceptor(axiosInstance, signatureSecret) {
 }
 
 // src/client.ts
-var API_VERSION = "2026-05-20";
+var API_VERSION = "2026-06-22";
 var SDK_LANGUAGE = "typescript";
 var HumanosClient = class {
   constructor(clientConfig) {
@@ -2602,6 +2606,7 @@ function createWebhookHandler(config, handler) {
   DIDApiFp,
   DeliveryActionType,
   GenerateRequestDtoSecurityLevelEnum,
+  GenerateRequestUserDtoLanguageEnum,
   HumanosClient,
   IdentityEventEventTypeEnum,
   ListSecurityLevelEnum,

package/dist/index.mjs

@@ -663,7 +663,6 @@ var ListTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 var WorkflowsTypesEnum = {
@@ -671,7 +670,6 @@ var WorkflowsTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -807,7 +805,7 @@ var CredentialsApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -902,7 +900,7 @@ var CredentialsApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios5, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -967,7 +965,7 @@ var CredentialsApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.revoke(credentialId, aPIVersion, revokeCredentialDto, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1031,7 +1029,7 @@ var CredentialsApi = class extends BaseAPI {
     return CredentialsApiFp(this.configuration).revoke(credentialId, aPIVersion, revokeCredentialDto, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+   * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
    * @summary Verify VP
    * @param {VerifyPresentationDto} verifyPresentationDto 
    * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1291,7 +1289,7 @@ var RequestsApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1406,7 +1404,7 @@ var RequestsApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios7, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1481,7 +1479,7 @@ var RequestsApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.list(pageIndex, pageSize, search, dateFrom, dateTo, subject, internalId, securityLevel, aPIVersion, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)
@@ -1555,7 +1553,7 @@ var RequestsApi = class extends BaseAPI {
     return RequestsApiFp(this.configuration).list(pageIndex, pageSize, search, dateFrom, dateTo, subject, internalId, securityLevel, aPIVersion, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+   * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
    * @summary Resend OTP
    * @param {string} requestId Unique identifier of the  request.
    * @param {string} [contact] Verified contact value (email or phone)
@@ -1825,7 +1823,7 @@ var WebhooksApiAxiosParamCreator = function(configuration) {
       };
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1922,7 +1920,7 @@ var WebhooksApiFp = function(configuration) {
       return (axios2, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios9, BASE_PATH, configuration)(axios2, localVarOperationServerBasePath || basePath);
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -1977,7 +1975,7 @@ var WebhooksApiFactory = function(configuration, basePath, axios2) {
       return localVarFp.identity(identityEvent, aPIVersion, options).then((request) => request(axios2, basePath));
     },
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2026,7 +2024,7 @@ var WebhooksApi = class extends BaseAPI {
     return WebhooksApiFp(this.configuration).identity(identityEvent, aPIVersion, options).then((request) => request(this.axios, this.basePath));
   }
   /**
-   * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+   * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
    * @summary OTP Failed Event
    * @param {OtpFailedEvent} otpFailedEvent 
    * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -2181,6 +2179,14 @@ var GenerateRequestDtoSecurityLevelEnum = {
   HumanosRevalidation: "HUMANOS_REVALIDATION"
 };
 
+// generated/models/generate-request-user-dto.ts
+var GenerateRequestUserDtoLanguageEnum = {
+  Eng: "ENG",
+  Prt: "PRT",
+  Spa: "SPA",
+  Fra: "FRA"
+};
+
 // generated/models/identity-event.ts
 var IdentityEventEventTypeEnum = {
   Identity: "identity"
@@ -2245,7 +2251,6 @@ var ResourceEntityTypeEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2255,7 +2260,6 @@ var ResourceMinimalEntityTypeEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2265,7 +2269,6 @@ var ResourceQueryTypesEnum = {
   Form: "FORM",
   Document: "DOCUMENT",
   Json: "JSON",
-  Payment: "PAYMENT",
   Policy: "POLICY"
 };
 
@@ -2342,7 +2345,7 @@ function applySignatureInterceptor(axiosInstance, signatureSecret) {
 }
 
 // src/client.ts
-var API_VERSION = "2026-05-20";
+var API_VERSION = "2026-06-22";
 var SDK_LANGUAGE = "typescript";
 var HumanosClient = class {
   constructor(clientConfig) {
@@ -2491,6 +2494,7 @@ export {
   DIDApiFp,
   DeliveryActionType,
   GenerateRequestDtoSecurityLevelEnum,
+  GenerateRequestUserDtoLanguageEnum,
   HumanosClient,
   IdentityEventEventTypeEnum,
   ListSecurityLevelEnum,

package/generated/.openapi-generator/FILES

@@ -51,6 +51,8 @@ models/evidence.ts
 models/generate-credential-entity.ts
 models/generate-request-dto.ts
 models/generate-request-entity.ts
+models/generate-request-iframe-dto.ts
+models/generate-request-user-dto.ts
 models/generate-subject-entity.ts
 models/group-entity.ts
 models/groups-entity.ts
@@ -58,7 +60,8 @@ models/identity-dto.ts
 models/identity-event-decision.ts
 models/identity-event-user.ts
 models/identity-event.ts
-models/identity-payload.ts
+models/identity-webhook-issue-date.ts
+models/identity-webhook.ts
 models/index.ts
 models/organization-data-entity.ts
 models/otp-error.ts

package/generated/api/actions-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 

package/generated/api/activity-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 

package/generated/api/approval-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 
@@ -304,7 +304,6 @@ export const ListTypesEnum = {
     Form: 'FORM',
     Document: 'DOCUMENT',
     Json: 'JSON',
-    Payment: 'PAYMENT',
     Policy: 'POLICY'
 } as const;
 export type ListTypesEnum = typeof ListTypesEnum[keyof typeof ListTypesEnum];
@@ -316,7 +315,6 @@ export const WorkflowsTypesEnum = {
     Form: 'FORM',
     Document: 'DOCUMENT',
     Json: 'JSON',
-    Payment: 'PAYMENT',
     Policy: 'POLICY'
 } as const;
 export type WorkflowsTypesEnum = typeof WorkflowsTypesEnum[keyof typeof WorkflowsTypesEnum];

package/generated/api/credentials-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 
@@ -220,7 +220,7 @@ export const CredentialsApiAxiosParamCreator = function (configuration?: Configu
             };
         },
         /**
-         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
          * @summary Verify VP
          * @param {VerifyPresentationDto} verifyPresentationDto 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -328,7 +328,7 @@ export const CredentialsApiFp = function(configuration?: Configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
          * @summary Verify VP
          * @param {VerifyPresentationDto} verifyPresentationDto 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -398,7 +398,7 @@ export const CredentialsApiFactory = function (configuration?: Configuration, ba
             return localVarFp.revoke(credentialId, aPIVersion, revokeCredentialDto, options).then((request) => request(axios, basePath));
         },
         /**
-         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+         * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
          * @summary Verify VP
          * @param {VerifyPresentationDto} verifyPresentationDto 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -473,7 +473,7 @@ export class CredentialsApi extends BaseAPI {
     }
 
     /**
-     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.
+     * Evaluate a VP against runtime context. On allow, returns 200 with the signed receipt. On deny, returns 403 with the reason, evaluations, and receipt in the error body. If the mandate has no constraint schema, only signatures, verifier access, and validity are checked.  Supply the presentation exactly as returned by POST /credential/vp/:vcId — do not re-serialize or modify it. Pass it as either `presentation` (the signed VP object) or `presentationEncoded` (its base64 string); at least one is required (400 otherwise), and if both are sent `presentationEncoded` wins. `presentationEncoded` is the recommended field: being an opaque string it is immune to JSON re-serialization / formatting changes (e.g. some HTTP clients reformatting date strings) that would otherwise break the signature.
      * @summary Verify VP
      * @param {VerifyPresentationDto} verifyPresentationDto 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.

package/generated/api/didapi.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 

package/generated/api/requests-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 
@@ -242,7 +242,7 @@ export const RequestsApiAxiosParamCreator = function (configuration?: Configurat
             };
         },
         /**
-         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
          * @summary Resend OTP
          * @param {string} requestId Unique identifier of the  request.
          * @param {string} [contact] Verified contact value (email or phone)
@@ -373,7 +373,7 @@ export const RequestsApiFp = function(configuration?: Configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
          * @summary Resend OTP
          * @param {string} requestId Unique identifier of the  request.
          * @param {string} [contact] Verified contact value (email or phone)
@@ -453,7 +453,7 @@ export const RequestsApiFactory = function (configuration?: Configuration, baseP
             return localVarFp.list(pageIndex, pageSize, search, dateFrom, dateTo, subject, internalId, securityLevel, aPIVersion, options).then((request) => request(axios, basePath));
         },
         /**
-         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+         * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
          * @summary Resend OTP
          * @param {string} requestId Unique identifier of the  request.
          * @param {string} [contact] Verified contact value (email or phone)
@@ -538,7 +538,7 @@ export class RequestsApi extends BaseAPI {
     }
 
     /**
-     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS (depending on their contact type) with a code and a signing URL.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
+     * Resend a One-Time Password (OTP) to a subject for credential approval, via email or SMS.      The endpoint validates:   - The request is not canceled   - Maximum attempts have not been reached, only successful OTP sends count towards resend limits   - Sufficient time has passed since the last successful resend   - Billing restrictions apply
      * @summary Resend OTP
      * @param {string} requestId Unique identifier of the  request.
      * @param {string} [contact] Verified contact value (email or phone)

package/generated/api/user-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 

package/generated/api/webhooks-api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  * 
@@ -116,7 +116,7 @@ export const WebhooksApiAxiosParamCreator = function (configuration?: Configurat
             };
         },
         /**
-         * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+         * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
          * @summary OTP Failed Event
          * @param {OtpFailedEvent} otpFailedEvent 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -234,7 +234,7 @@ export const WebhooksApiFp = function(configuration?: Configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+         * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
          * @summary OTP Failed Event
          * @param {OtpFailedEvent} otpFailedEvent 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -294,7 +294,7 @@ export const WebhooksApiFactory = function (configuration?: Configuration, baseP
             return localVarFp.identity(identityEvent, aPIVersion, options).then((request) => request(axios, basePath));
         },
         /**
-         * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+         * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
          * @summary OTP Failed Event
          * @param {OtpFailedEvent} otpFailedEvent 
          * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.
@@ -352,7 +352,7 @@ export class WebhooksApi extends BaseAPI {
     }
 
     /**
-     * Fired when an OTP delivery to the subject fails.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
+     * Fired when an OTP **SMS** could not be delivered: every eligible SMS provider was tried (synchronously or via carrier delivery reports) and none succeeded. Email OTP failures do not emit this event. Carrier delivery reports are asynchronous and occasionally corrected to \"delivered\" afterwards, so treat this event as *Humanos stopped retrying*, not as a guarantee the SMS never arrived. The safe reaction is to `PATCH` the `otp.resendEndpoint` URL exactly as delivered — a resend issues a fresh code and invalidates the old one, so it is harmless even if the original message did arrive late.  **Inbound webhook callback** — Humanos POSTs this payload to your registered webhook URL. This is not an endpoint you call; it is documented as a path so SDK code generators emit a typed payload model.
      * @summary OTP Failed Event
      * @param {OtpFailedEvent} otpFailedEvent 
      * @param {string} [aPIVersion] Pin responses to a specific API version (YYYY-MM-DD). When omitted, defaults to the version stored in your issuer config or today\'s date.

package/generated/api.ts

@@ -2,7 +2,7 @@
 /* eslint-disable */
 /**
  * Humanos API
- * Humanos API
+ * Humanos App Backend API
  *
  * The version of the OpenAPI document: 1.0
  *