n8n 2.33.2 → 2.34.0

package/dist/public-api/v1/openapi.yml

@@ -47,8 +47,12 @@ tags:
     description: Operations about projects
   - name: SecurityPolicy
     description: Operations about the instance security policy settings
+  - name: SettingsLdap
+    description: Operations about LDAP settings
   - name: SettingsOtel
     description: Operations about OpenTelemetry settings
+  - name: SettingsSsoOidc
+    description: Operations about OIDC SSO settings
   - name: SettingsSsoSaml
     description: Operations about SAML SSO settings
   - name: SourceControl
@@ -108,6 +112,109 @@ paths:
           $ref: '#/components/responses/unauthorized'
         '500':
           description: Internal server error.
+  /settings/ldap:
+    get:
+      x-eov-operation-id: getLdapConfiguration
+      x-required-scope: ldap:manage
+      x-eov-operation-handler: v1/handlers/ldap/ldap.handler
+      tags:
+        - SettingsLdap
+      summary: Retrieve the LDAP configuration
+      description: |
+        Retrieve the current LDAP configuration, including every field exposed in the UI. The binding admin password is redacted on read. Requires the `ldap:manage` scope and the LDAP feature to be licensed.
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ldap-configuration'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+    put:
+      x-eov-operation-id: updateLdapConfiguration
+      x-required-scope: ldap:manage
+      x-eov-operation-handler: v1/handlers/ldap/ldap.handler
+      tags:
+        - SettingsLdap
+      summary: Set the LDAP configuration
+      description: |
+        Replace the LDAP configuration with the provided full object (partial updates are not supported). For bindingAdminPassword, submit the blanking placeholder from a prior GET to keep the stored password unchanged. Requires the `ldap:manage` scope  and the LDAP feature to be licensed. Setting loginEnabled to false is destructive  and it deletes all stored LDAP user identities and disables synchronization.
+      requestBody:
+        description: The full LDAP configuration to set.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ldap-configuration.update'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ldap-configuration'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+  /settings/ldap/sync:
+    get:
+      x-eov-operation-id: getLdapSync
+      x-required-scope: ldap:sync
+      x-eov-operation-handler: v1/handlers/ldap/ldap.handler
+      tags:
+        - SettingsLdap
+      summary: Retrieve LDAP synchronization history
+      description: |
+        Retrieve the history of LDAP synchronizations, most recent first. Requires the `ldap:sync` scope and the LDAP feature to be licensed.
+      parameters:
+        - $ref: '#/components/parameters/limit'
+        - $ref: '#/components/parameters/cursor'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ldap-sync-history.list'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+    post:
+      x-eov-operation-id: runLdapSync
+      x-required-scope: ldap:sync
+      x-eov-operation-handler: v1/handlers/ldap/ldap.handler
+      tags:
+        - SettingsLdap
+      summary: Trigger an LDAP synchronization
+      description: |
+        Manually trigger an LDAP synchronization. The response returns the new sync history record. Requires the `ldap:sync` scope and the LDAP feature to be licensed.
+      requestBody:
+        description: Synchronization parameters.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ldap-sync.update'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ldap-sync-history'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
   /settings/security-policy:
     get:
       x-eov-operation-id: getSecurityPolicy
@@ -242,6 +349,58 @@ paths:
           $ref: '#/components/responses/unauthorized'
         '403':
           $ref: '#/components/responses/forbidden'
+  /settings/sso/oidc:
+    get:
+      x-eov-operation-id: getOidcConfiguration
+      x-required-scope: oidc:manage
+      x-eov-operation-handler: v1/handlers/sso-oidc/sso-oidc.handler
+      tags:
+        - SettingsSsoOidc
+      summary: Retrieve the OIDC SSO configuration
+      description: |
+        Retrieve the current OIDC SSO configuration, including every field exposed in the UI. The client secret is redacted on read and is never echoed back in plaintext. Requires the `oidc:manage` scope and the OIDC feature to be licensed.
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/oidc-configuration'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+    put:
+      x-eov-operation-id: setOidcConfiguration
+      x-required-scope: oidc:manage
+      x-eov-operation-handler: v1/handlers/sso-oidc/sso-oidc.handler
+      tags:
+        - SettingsSsoOidc
+      summary: Set the OIDC SSO configuration
+      description: |
+        Set the OIDC SSO configuration. The update takes effect exactly as it would from the UI, using the same validation. `clientId`, `clientSecret` and `discoveryEndpoint` are required; submit the redacted client secret sentinel to keep the stored secret unchanged. Requires the `oidc:manage` scope and the OIDC feature to be licensed. The client secret is redacted in the response. When the configuration is managed declaratively (via environment variables), the write is rejected with 409 and no changes are made.
+      requestBody:
+        description: The OIDC SSO configuration to set.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/oidc-configuration.update'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/oidc-configuration'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '409':
+          $ref: '#/components/responses/conflict'
   /settings/sso/saml:
     get:
       x-eov-operation-id: getSamlConfiguration
@@ -1131,6 +1290,12 @@ paths:
           $ref: '#/components/responses/unauthorized'
         '404':
           $ref: '#/components/responses/notFound'
+        '409':
+          description: Conflict, e.g. re-publication blocked by an open workflow review (then `reason` and `workflowReviewRequestId` are present; the update itself is still saved as a draft) or a webhook path conflict.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/workflowPublishBlockedError'
   /workflows/{id}/history:
     get:
       operationId: getWorkflowHistory
@@ -1228,6 +1393,12 @@ paths:
           $ref: '#/components/responses/unauthorized'
         '404':
           $ref: '#/components/responses/notFound'
+        '409':
+          description: Conflict, e.g. publication blocked by an open workflow review (then `reason` and `workflowReviewRequestId` are present) or a webhook path conflict.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/workflowPublishBlockedError'
   /workflows/{id}/deactivate:
     post:
       x-eov-operation-id: deactivateWorkflow
@@ -1292,6 +1463,12 @@ paths:
           $ref: '#/components/responses/unauthorized'
         '404':
           $ref: '#/components/responses/notFound'
+        '409':
+          description: Conflict, e.g. publication blocked by an open workflow review (then `reason` and `workflowReviewRequestId` are present) or a webhook path conflict.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/workflowPublishBlockedError'
   /workflows/{id}/unpublish:
     post:
       x-eov-operation-id: unpublishWorkflow
@@ -3305,9 +3482,9 @@ paths:
 
         Imports a gzip-compressed tar package (`.n8np`) into the target project. Send the
         archive as the multipart field `package`. Optional routing uses form fields
-        `projectId` and `folderId` (omit or send empty for defaults). The optional
-        `credentialMatchingMode`, `credentialMissingMode`, `bindings`,
-        `workflowIdPolicy`, and `workflowPublishingPolicy` fields take their defaults when omitted. The required
+        `projectId` and `folderId` (omit or send empty for defaults). Every optional
+        mode/policy field (credential, workflow, folder, data table, variable, and tag)
+        takes its default when omitted. The required
         `workflowConflictPolicy` field controls what happens when a package workflow
         matches an existing workflow by source id in the target project. Maximum upload
         size is `N8N_ENDPOINTS_PAYLOAD_SIZE_MAX` MB (default 16).
@@ -3435,9 +3612,34 @@ paths:
                   enum:
                     - do-nothing
                     - must-preexist
+                    - create-stub
                   default: do-nothing
                   description: |
-                    Controls what happens when a variable referenced by the package's workflows is absent from the target project and the global scope (lookup order: project, then global). `do-nothing` (default) imports the workflows without creating the missing variable and lists its name under `variables.missing` in the response so the caller can fill it in afterwards. `must-preexist` rejects the import unless every referenced variable already resolves. Neither mode ever creates a variable.
+                    Controls what happens when a variable referenced by the package's workflows is absent from the target project and the global scope (lookup order: project, then global). `do-nothing` (default) imports the workflows without creating the missing variable and lists its name under `variables.missing`. `must-preexist` rejects the import unless every referenced variable already resolves. `create-stub` creates each missing variable with an empty value at the placement scope (see `variableParentPolicy`) and lists the created names under `variables.stubbed`. Any `create-stub` import that has variable requirements needs an API key carrying the `variable:create` scope (owner/admin keys only) — this applies to project placement too, not only `variableParentPolicy=global`.
+                variableParentPolicy:
+                  type: string
+                  enum:
+                    - project
+                    - global
+                  description: |
+                    Where `create-stub` creates missing variables for workflow/folder packages. `project` — also the behaviour when the field is omitted — creates them in the import target project (`projectId`, else the caller's personal project). `global` creates them at the global scope. The `variable:create` API key scope requirement described under `variableMissingMode` applies to both placements. Must be omitted for project packages, which reject it with a 400: their placement follows the package layout, where a variable bundled under a project is created in that project and one bundled at the top level is created globally.
+                tagMissingMode:
+                  type: string
+                  enum:
+                    - create
+                    - do-nothing
+                  default: create
+                  description: |
+                    What to do when a tag referenced by the package's workflows has no tag with the same id on the target instance (tags are matched by source id, never by name). `create` (default) creates the tag globally with its package (source) id and name; when the import would create a tag this needs an API key carrying the `tag:create` scope. `do-nothing` imports the workflows without the missing tags — nothing is created and the dropped names are listed under `tags.skipped`.
+                tagConflictPolicy:
+                  type: string
+                  enum:
+                    - skip
+                    - fail
+                    - rename
+                  default: skip
+                  description: |
+                    What to do when a referenced tag conflicts on the target instance — either the same-id target tag carries a different name (rename drift), or the tag's name is already held by a different tag (name collision). `skip` (default) drops the conflicted tags from the import (not created, not renamed, not attached anywhere; the import proceeds and lists them under `tags.skipped`). `fail` rejects the import with a 409. `rename` renames a drifted target tag to the package name and needs an API key carrying the `tag:update` scope when the import would rename a tag; a name collision — including a drifted tag whose package name is held by another tag — still rejects the import (rename degrades to fail).
       responses:
         '200':
           description: Import succeeded; the listed workflows were written to the target project.
@@ -3453,6 +3655,7 @@ paths:
                   - bindings
                   - credentials
                   - variables
+                  - tags
                 properties:
                   package:
                     type: object
@@ -3622,10 +3825,11 @@ paths:
                   variables:
                     type: object
                     description: |
-                      Resolution of the package's variable requirements. Names only — values never travel in the response. For project packages, resolution runs per project, so a name that resolves in some projects but not others appears in both lists.
+                      Resolution of the package's variable requirements. Names only — values never travel in the response. For project packages these arrays are package-level unions of per-destination outcomes and may overlap (a name matched in one project and stubbed in another appears in both `matched` and `stubbed`); classification under concurrent external writes is best-effort.
                     required:
                       - matched
                       - missing
+                      - stubbed
                     properties:
                       matched:
                         type: array
@@ -3638,7 +3842,47 @@ paths:
                         items:
                           type: string
                         description: |
-                          Variable names that did not resolve. Under `variableMissingMode=do-nothing` these are warnings — the import still succeeds and nothing is created.
+                          Variable names still unresolved after import. Under `variableMissingMode=do-nothing` these are warnings — the import still succeeds and nothing is created. A successful `create-stub` import normally leaves this empty.
+                      stubbed:
+                        type: array
+                        items:
+                          type: string
+                        description: |
+                          Variable names created with an empty value by this import under `variableMissingMode=create-stub`. Empty for other modes.
+                  tags:
+                    type: object
+                    description: |
+                      Resolution of the tags referenced by the imported workflows, matched by source id. Tag names only.
+                    required:
+                      - matched
+                      - created
+                      - renamed
+                      - skipped
+                    properties:
+                      matched:
+                        type: array
+                        items:
+                          type: string
+                        description: |
+                          Tags that resolved to an existing tag with the same id and name; attached as-is.
+                      created:
+                        type: array
+                        items:
+                          type: string
+                        description: |
+                          Tags created by this import with their package (source) id and name, under `tagMissingMode=create`.
+                      renamed:
+                        type: array
+                        items:
+                          type: string
+                        description: |
+                          Target tags renamed to the package name under `tagConflictPolicy=rename`; listed by their new name.
+                      skipped:
+                        type: array
+                        items:
+                          type: string
+                        description: |
+                          Tags dropped from the import — not created, not renamed, and not attached to any imported workflow — under `tagMissingMode=do-nothing` or `tagConflictPolicy=skip`.
                   bindings:
                     type: object
                     description: |
@@ -3667,7 +3911,7 @@ paths:
           $ref: '#/components/responses/notFound'
         '409':
           description: |
-            Import blocked by at least one conflict among the issues — a workflow source-id conflict or a folder conflict (id under a different parent, id owned by another project, or a `fail`-policy match).
+            Import blocked by at least one conflict among the issues — a workflow source-id conflict, a folder conflict (id under a different parent, id owned by another project, or a `fail`-policy match), or a tag conflict (rename drift or name collision).
           content:
             application/json:
               schema:
@@ -3684,7 +3928,7 @@ paths:
                       $ref: '#/components/schemas/importBlockingIssue'
         '422':
           description: |
-            Import blocked by non-conflict issues only (e.g. unresolved credentials or variables, or node types this instance does not have under `missingNodeTypeMode=fail`).
+            Import blocked by non-conflict issues only (e.g. unresolved credentials or variables, node types this instance does not have under `missingNodeTypeMode=fail`, or variable stubs whose creation would exceed the instance variable quota).
           content:
             application/json:
               schema:
@@ -3978,6 +4222,321 @@ components:
                   - kind: community
                     nodeType: n8n-nodes-test.test
                     packageUrl: https://www.npmjs.com/package/n8n-nodes-test
+    ldap-configuration:
+      type: object
+      additionalProperties: false
+      description: |
+        Full LDAP configuration. Every field is returned by GET; send the full object back as PUT body.
+      required:
+        - loginEnabled
+        - loginLabel
+        - connectionUrl
+        - allowUnauthorizedCerts
+        - connectionSecurity
+        - connectionPort
+        - baseDn
+        - bindingAdminDn
+        - bindingAdminPassword
+        - firstNameAttribute
+        - lastNameAttribute
+        - emailAttribute
+        - loginIdAttribute
+        - ldapIdAttribute
+        - userFilter
+        - synchronizationEnabled
+        - synchronizationInterval
+        - searchPageSize
+        - searchTimeout
+        - enforceEmailUniqueness
+      properties:
+        loginEnabled:
+          type: boolean
+          description: Whether LDAP login is enabled.
+          example: false
+        loginLabel:
+          type: string
+          description: Label shown on the LDAP login button.
+          example: LDAP
+        connectionUrl:
+          type: string
+          description: LDAP server URL.
+          example: ldap://ldap.example.com
+        allowUnauthorizedCerts:
+          type: boolean
+          description: Whether to allow unauthorized (self-signed) certificates.
+          example: false
+        connectionSecurity:
+          type: string
+          enum:
+            - none
+            - tls
+            - startTls
+          description: TLS/SSL security mode for the LDAP connection.
+          example: none
+        connectionPort:
+          type: integer
+          description: LDAP server port.
+          example: 389
+        baseDn:
+          type: string
+          description: Base DN for LDAP search queries.
+          example: dc=example,dc=com
+        bindingAdminDn:
+          type: string
+          description: DN of the LDAP admin user for binding.
+          example: cn=admin,dc=example,dc=com
+        bindingAdminPassword:
+          type: string
+          description: |
+            Password for the LDAP admin user. Redacted on GET; returns the blanking placeholder when a password is stored, empty string when unset. Send the blanking placeholder from a prior GET to keep the stored password unchanged.
+        firstNameAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's first name.
+          example: givenName
+        lastNameAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's last name.
+          example: sn
+        emailAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's email.
+          example: mail
+        loginIdAttribute:
+          type: string
+          description: LDAP attribute used for login (usually the same as emailAttribute).
+          example: mail
+        ldapIdAttribute:
+          type: string
+          description: LDAP attribute that uniquely identifies a user.
+          example: uid
+        userFilter:
+          type: string
+          description: |
+            Additional LDAP filter to apply when searching for users. Use an empty string for no additional filter.
+          example: (objectClass=inetOrgPerson)
+        synchronizationEnabled:
+          type: boolean
+          description: Whether automatic LDAP synchronization is enabled.
+          example: false
+        synchronizationInterval:
+          type: integer
+          description: Interval in minutes between automatic synchronizations. Ignored if synchronizationEnabled is false.
+          example: 60
+        searchPageSize:
+          type: integer
+          description: Number of LDAP entries to fetch per search page.
+          example: 1000
+        searchTimeout:
+          type: integer
+          description: LDAP search timeout in seconds.
+          example: 60
+        enforceEmailUniqueness:
+          type: boolean
+          description: |
+            Whether to enforce that email addresses are unique across LDAP users. When true, if two users have the same email, only the first will be imported.
+          example: true
+    ldap-configuration.update:
+      type: object
+      additionalProperties: false
+      description: Full LDAP configuration. Use empty strings for unset fields.
+      required:
+        - loginEnabled
+        - loginLabel
+        - connectionUrl
+        - allowUnauthorizedCerts
+        - connectionSecurity
+        - connectionPort
+        - baseDn
+        - bindingAdminDn
+        - bindingAdminPassword
+        - firstNameAttribute
+        - lastNameAttribute
+        - emailAttribute
+        - loginIdAttribute
+        - ldapIdAttribute
+        - userFilter
+        - synchronizationEnabled
+        - synchronizationInterval
+        - searchPageSize
+        - searchTimeout
+        - enforceEmailUniqueness
+      properties:
+        loginEnabled:
+          type: boolean
+          description: |
+            Whether LDAP login is enabled. Setting this to false is destructive — it deletes all stored LDAP user identities and disables synchronization.
+          example: false
+        loginLabel:
+          type: string
+          description: Label shown on the LDAP login button.
+          example: LDAP
+        connectionUrl:
+          type: string
+          description: LDAP server URL.
+          example: ldap://ldap.example.com
+        allowUnauthorizedCerts:
+          type: boolean
+          description: Whether to allow unauthorized (self-signed) certificates.
+          example: false
+        connectionSecurity:
+          type: string
+          enum:
+            - none
+            - tls
+            - startTls
+          description: TLS/SSL security mode for the LDAP connection.
+          example: none
+        connectionPort:
+          type: integer
+          description: LDAP server port.
+          example: 389
+        baseDn:
+          type: string
+          description: Base DN for LDAP search queries.
+          example: dc=example,dc=com
+        bindingAdminDn:
+          type: string
+          description: DN of the LDAP admin user for binding.
+          example: cn=admin,dc=example,dc=com
+        bindingAdminPassword:
+          type: string
+          description: |
+            Password for the LDAP admin user. To keep an existing password unchanged, submit the blanking placeholder from a prior GET response. Use an empty string to clear the password.
+        firstNameAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's first name.
+          example: givenName
+        lastNameAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's last name.
+          example: sn
+        emailAttribute:
+          type: string
+          description: LDAP attribute mapped to the user's email.
+          example: mail
+        loginIdAttribute:
+          type: string
+          description: LDAP attribute used for login (usually the same as emailAttribute).
+          example: mail
+        ldapIdAttribute:
+          type: string
+          description: LDAP attribute that uniquely identifies a user.
+          example: uid
+        userFilter:
+          type: string
+          description: |
+            Additional LDAP filter to apply when searching for users. Use an empty string for no additional filter.
+          example: (objectClass=inetOrgPerson)
+        synchronizationEnabled:
+          type: boolean
+          description: Whether automatic LDAP synchronization is enabled.
+          example: false
+        synchronizationInterval:
+          type: integer
+          description: Interval in minutes between automatic synchronizations. Ignored if synchronizationEnabled is false.
+          example: 60
+        searchPageSize:
+          type: integer
+          description: Number of LDAP entries to fetch per search page.
+          example: 1000
+        searchTimeout:
+          type: integer
+          description: LDAP search timeout in seconds.
+          example: 60
+        enforceEmailUniqueness:
+          type: boolean
+          description: |
+            Whether to enforce that email addresses are unique across LDAP users. When true, if two users have the same email, only the first will be imported.
+          example: true
+    ldap-sync-history:
+      type: object
+      additionalProperties: false
+      description: LDAP synchronization history record.
+      required:
+        - id
+        - runMode
+        - status
+        - startedAt
+        - endedAt
+        - scanned
+        - created
+        - updated
+        - disabled
+        - error
+      properties:
+        id:
+          type: integer
+          description: Unique identifier for this sync run.
+          example: 1
+        runMode:
+          type: string
+          enum:
+            - dry
+            - live
+          description: Whether the sync was a dry run or applied live.
+          example: live
+        status:
+          type: string
+          description: Status of the synchronization (e.g., success, error).
+          example: success
+        startedAt:
+          type: string
+          format: date-time
+          description: Timestamp when the synchronization started.
+          example: '2025-07-21T10:30:00Z'
+        endedAt:
+          type: string
+          format: date-time
+          description: Timestamp when the synchronization completed.
+          example: '2025-07-21T10:35:00Z'
+        scanned:
+          type: integer
+          description: Number of LDAP entries scanned during synchronization.
+          example: 42
+        created:
+          type: integer
+          description: Number of new users created during synchronization.
+          example: 5
+        updated:
+          type: integer
+          description: Number of existing users updated during synchronization.
+          example: 3
+        disabled:
+          type: integer
+          description: Number of users disabled during synchronization.
+          example: 0
+        error:
+          type: string
+          description: Error message if the synchronization failed. Empty string if successful.
+          example: ''
+    ldap-sync-history.list:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/ldap-sync-history'
+        nextCursor:
+          type: string
+          nullable: true
+          description: |
+            Paginate through the synchronization history by setting the cursor parameter to the nextCursor attribute returned by the previous request. A null value means there are no more records.
+          example: MTIzZTQ1NjctZTg5Yi0xMmQzLWE0NTYtNDI2NjE0MTc0MDA
+    ldap-sync.update:
+      type: object
+      additionalProperties: false
+      description: Request body for triggering an LDAP synchronization.
+      required:
+        - type
+      properties:
+        type:
+          type: string
+          enum:
+            - live
+            - dry
+          description: |
+            Type of synchronization. 'live' applies changes to the database, 'dry' performs a test run without persisting changes.
+          example: live
     security-policy:
       type: object
       additionalProperties: false
@@ -4186,6 +4745,130 @@ components:
           description: |
             The error reported by the collector or exporter. Present only when `success` is false.
           example: 'Failed to connect: 401 Unauthorized'
+    oidc-configuration:
+      type: object
+      additionalProperties: false
+      required:
+        - clientId
+        - clientSecret
+        - discoveryEndpoint
+        - loginEnabled
+        - prompt
+        - authenticationContextClassReference
+        - additionalScopes
+        - rpInitiatedLogoutEnabled
+      properties:
+        clientId:
+          type: string
+          description: The client ID issued when registering n8n with the OIDC provider.
+          example: n8n-client
+        clientSecret:
+          type: string
+          description: |
+            The client secret issued when registering n8n with the OIDC provider. Redacted on read when set; never echoed back in plaintext.
+          example: '**hidden**'
+        discoveryEndpoint:
+          type: string
+          format: uri
+          description: The OIDC provider's well-known discovery endpoint.
+          example: https://accounts.google.com/.well-known/openid-configuration
+        loginEnabled:
+          type: boolean
+          description: Whether OIDC single sign-on is enabled.
+          example: false
+        prompt:
+          type: string
+          enum:
+            - none
+            - login
+            - consent
+            - select_account
+            - create
+          description: The prompt parameter to use when authenticating with the OIDC provider.
+          example: select_account
+        authenticationContextClassReference:
+          type: array
+          items:
+            type: string
+          description: |
+            ACR values to include in the authorization request (acr_values parameter), in order of preference.
+          example:
+            - mfa
+            - pwd
+        additionalScopes:
+          type: string
+          description: |
+            Additional scopes to request, space separated. n8n always requests `openid`, `profile` and `email`.
+          example: groups roles
+        rpInitiatedLogoutEnabled:
+          type: boolean
+          description: |
+            Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.
+          example: false
+    oidc-configuration.update:
+      type: object
+      additionalProperties: false
+      description: |
+        Full OIDC SSO configuration to set. This is a full replacement: every writable field must be provided. Partial updates are rejected. Submit the redacted secret sentinel  for `clientSecret` to keep the stored secret unchanged.
+      required:
+        - clientId
+        - clientSecret
+        - discoveryEndpoint
+        - loginEnabled
+        - prompt
+        - authenticationContextClassReference
+        - additionalScopes
+        - rpInitiatedLogoutEnabled
+      properties:
+        clientId:
+          type: string
+          minLength: 1
+          description: The client ID issued when registering n8n with the OIDC provider.
+          example: n8n-client
+        clientSecret:
+          type: string
+          minLength: 1
+          description: |
+            The client secret issued when registering n8n with the OIDC provider. Submit the redacted sentinel value returned on read to keep the stored secret unchanged.
+          example: my-client-secret
+        discoveryEndpoint:
+          type: string
+          format: uri
+          description: The OIDC provider's well-known discovery endpoint.
+          example: https://accounts.google.com/.well-known/openid-configuration
+        loginEnabled:
+          type: boolean
+          description: Whether OIDC single sign-on is enabled.
+          example: false
+        prompt:
+          type: string
+          enum:
+            - none
+            - login
+            - consent
+            - select_account
+            - create
+          description: The prompt parameter to use when authenticating.
+          example: select_account
+        authenticationContextClassReference:
+          type: array
+          items:
+            type: string
+          description: |
+            ACR values to include in the authorization request (acr_values parameter), in order of preference. Use an empty array when unused.
+          example:
+            - mfa
+            - pwd
+        additionalScopes:
+          type: string
+          description: |
+            Additional scopes to request, space separated. n8n always requests `openid`, `profile` and `email`. Use an empty string when unused.
+          example: groups roles
+        rpInitiatedLogoutEnabled:
+          type: boolean
+          description: |
+            Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.
+          example: false
     saml-configuration:
       type: object
       additionalProperties: false
@@ -5418,6 +6101,21 @@ components:
             $ref: '#/components/schemas/sharedWorkflow'
         activeVersion:
           $ref: '#/components/schemas/activeVersion'
+    workflowPublishBlockedError:
+      type: object
+      description: Conflict response. `reason` and `workflowReviewRequestId` are present only when the conflict is an open workflow review blocking publication.
+      required:
+        - message
+      properties:
+        message:
+          type: string
+        reason:
+          type: string
+          enum:
+            - review_pending
+            - changes_requested
+        workflowReviewRequestId:
+          type: string
     workflowVersionListItem:
       type: object
       additionalProperties: false
@@ -6559,13 +7257,17 @@ components:
           type: boolean
           default: true
           description: Whether values of variables referenced by the exported workflows are bundled into the package. When `false`, variables still travel as name/type files and are listed in the package requirements, but no values travel with the package.
+        includeTags:
+          type: boolean
+          default: true
+          description: Whether tags assigned to the exported workflows are bundled into the package. When `false`, no tag files, tag references, or tag requirements travel with the package.
         missingWorkflowDependencyPolicy:
           type: string
           enum:
             - fail
             - reference-only
             - include-in-package
-          description: Policy for missing static sub-workflow dependencies. `fail` aborts the export when any static sub-workflow is missing from the package; `include-in-package` automatically adds missing static sub-workflows. `reference-only` is reserved for a future export mode.
+          description: Policy for missing static sub-workflow dependencies. `fail` aborts the export when any static sub-workflow is missing from the package; `include-in-package` automatically adds missing static sub-workflows. `reference-only` keeps missing static sub-workflows out of the package and lists them in the package requirements as workflows expected to already exist on the target.
           example: fail
           default: fail
     importBlockingIssue:
@@ -6742,6 +7444,50 @@ components:
               type: array
               items:
                 type: string
+        - type: object
+          description: |
+            A tag referenced by the package's workflows that could not be resolved on the target instance. `kind` distinguishes the cause: `rename-drift` (the same-id target tag carries a different name — under `tagConflictPolicy=fail`, or `rename` when the package name is held by another tag), `name-collision` (the id is free but the name belongs to a different tag, under `tagMissingMode=create` with `tagConflictPolicy=fail` or `rename`), `invalid-name` / `invalid-id` (the package tag's name or id cannot be written on this instance), or `permission-denied` (the importing user lacks the global `tag:create` / `tag:update` scope the plan needs).
+          required:
+            - type
+            - kind
+            - usedByWorkflows
+          properties:
+            type:
+              type: string
+              enum:
+                - tag-unresolved
+            kind:
+              type: string
+              enum:
+                - rename-drift
+                - name-collision
+                - invalid-name
+                - invalid-id
+                - permission-denied
+            sourceId:
+              type: string
+              description: Tag id as it appears in the package. Absent for `permission-denied`.
+            name:
+              type: string
+              description: The (trimmed) package tag name. Absent for `permission-denied`.
+            missingScope:
+              type: string
+              enum:
+                - tag:create
+                - tag:update
+              description: 'For `permission-denied`: the global scope the importing user lacks.'
+            existingTagId:
+              type: string
+              description: |
+                Id of the different target tag currently holding the wanted name, when one exists. Absent when two package tags collide with each other rather than with a target tag.
+            existingName:
+              type: string
+              description: 'For `rename-drift`: the current name of the same-id target tag.'
+            usedByWorkflows:
+              type: array
+              items:
+                type: string
+              description: Package workflow ids (non-skipped) that reference the tag.
         - type: object
           description: |
             A variable reference that could not be resolved in the target project or the global scope, under `variableMissingMode=must-preexist`.
@@ -6761,6 +7507,40 @@ components:
               type: array
               items:
                 type: string
+        - type: object
+          description: |
+            Creating the package's variable stubs under `variableMissingMode=create-stub` would exceed the instance variable quota (`quota:maxVariables`). Reported once for the whole import; nothing is created.
+          required:
+            - type
+            - limit
+            - remaining
+            - requested
+            - names
+            - usedByWorkflows
+          properties:
+            type:
+              type: string
+              enum:
+                - variable-limit-exceeded
+            limit:
+              type: integer
+              description: The instance variable quota.
+            remaining:
+              type: integer
+              description: Variable rows still available under the quota. The import is blocked because `requested` exceeds this, not because it exceeds `limit`.
+            requested:
+              type: integer
+              description: Number of new variable rows the import would create (destination-deduplicated).
+            names:
+              type: array
+              items:
+                type: string
+              description: The unique variable names the import would create.
+            usedByWorkflows:
+              type: array
+              items:
+                type: string
+              description: Package workflow ids that reference any of the listed variables.
     event-types:
       type: object
       additionalProperties: false