rebilly-js-sdk 62.221.0 → 62.222.1

package/CHANGELOG.md

@@ -1,3 +1,3 @@
-## 62.221.0 (2026-10-16)
+## 62.222.1 (2026-10-16)
 
 This was a version bump only for rebilly-js-sdk to align it with other projects, there were no code changes.

package/dist/rebilly-js-sdk.d.cts

@@ -1810,6 +1810,13 @@ declare namespace rebilly {
   type DeleteRoleResponse = operations['DeleteRole']['responses']['204']
   type DeleteRoleResponsePromise = Promise<{fields: DeleteRoleResponse}>
   
+  
+  type GetSecuritySettingsResponse = operations['GetSecuritySettings']['responses']['200']['content']['application/json']
+  type GetSecuritySettingsResponsePromise = Promise<{fields: GetSecuritySettingsResponse}>
+  type PutSecuritySettingsRequest = operations['PutSecuritySettings']['requestBody']['content']['application/json']
+  type PutSecuritySettingsResponse = operations['PutSecuritySettings']['responses']['200']['content']['application/json']
+  type PutSecuritySettingsResponsePromise = Promise<{fields: PutSecuritySettingsResponse}>
+  
   type GetSendThroughAttributionCollectionRequest = { eventType: string }
 
   type GetSendThroughAttributionCollectionResponse = operations['GetSendThroughAttributionCollection']['responses']['200']['content']['application/json'][0]
@@ -5356,13 +5363,27 @@ export interface corePaths {
     };
   };
   "/organizations": {
-    /** Retrieves a list of organizations. */
+    /**
+     * Retrieves a list of organizations.
+     * If an organization requires multi-factor authentication (MFA) and your session has not passed MFA,
+     * the response includes only `id`, `name`, `country`, `features`, `settings.security`, and `_links` for that organization,
+     * and omits all other fields.
+     * In that case, only `id`, `name`, and `features` are available as filter fields,
+     * and only `id` and `name` are available as sort fields.
+     * To require MFA, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+     */
     get: operations["GetOrganizationCollection"];
     /** Creates an organization. */
     post: operations["PostOrganization"];
   };
   "/organizations/{id}": {
-    /** Retrieves an organization with a specified ID. */
+    /**
+     * Retrieves an organization with a specified ID.
+     * If the organization requires multi-factor authentication (MFA) and your session has not passed MFA,
+     * the response includes only `id`, `name`, `country`, `features`, `settings.security`, and `_links`,
+     * and omits all other fields.
+     * To require MFA, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+     */
     get: operations["GetOrganization"];
     /** Updates an organization with a specified organization ID. */
     patch: operations["PatchOrganization"];
@@ -5693,6 +5714,26 @@ export interface corePaths {
       };
     };
   };
+  "/security-settings": {
+    /**
+     * Retrieves the sign-in security settings of the organization,
+     * and the number of users who have multi-factor authentication (MFA) set up.
+     * Settings apply to the current environment only: live and sandbox are configured separately.
+     */
+    get: operations["GetSecuritySettings"];
+    /**
+     * Updates the sign-in security settings of the organization.
+     * If `requireMfa` is `true`, every user who signs in to the Rebilly UI must pass multi-factor authentication (MFA).
+     * If the session of a user has not passed MFA, other operations respond with `403` and `error` is `mfa_required`.
+     * Only owners and administrators who are signed in to the Rebilly UI can change this setting.
+     * This setting does not apply to API keys, and a request that uses an API key cannot change this setting.
+     * To turn on `requireMfa`, the session must have passed MFA.
+     * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
+     * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+     * Settings apply to the current environment only: live and sandbox are configured separately.
+     */
+    put: operations["PutSecuritySettings"];
+  };
   "/send-through-attribution/{eventType}": {
     /** Retrieves a list of email notifications, that have been sent through attribution, for a specified event type. */
     get: operations["GetSendThroughAttributionCollection"];
@@ -5770,7 +5811,19 @@ export interface corePaths {
     };
   };
   "/users": {
-    /** Retrieves a list of users. */
+    /**
+     * Retrieves a list of users.
+     * To retrieve the users of the organization who have multi-factor authentication (MFA) set up,
+     * use `filter=mfaEnabled:true`.
+     * To retrieve the users who do not have MFA set up, including users who have not accepted their invitation,
+     * use `filter=mfaEnabled:false`.
+     * The `mfaEnabled` filter applies only to the list of users of an organization
+     * that has [security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings).
+     * Inactive users and Rebilly staff are not part of the `mfaEnabled` filter.
+     * User objects of Rebilly staff do not include `mfaEnabled`.
+     * The totals are the same as those returned by the [Retrieve security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings) operation.
+     * If the MFA status is temporarily unavailable, the response is `503` and `error` is `mfa_status_unavailable`.
+     */
     get: operations["GetUserCollection"];
     /** Creates a user. */
     post: operations["PostUser"];
@@ -6201,6 +6254,13 @@ export interface coreComponents {
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
+      /**
+       * Message that describes why the request is forbidden.
+       * Most responses use a descriptive message, such as `Not allowed to change security settings`.
+       * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
+       * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       */
+      error?: string;
     } & coreComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -12689,6 +12749,7 @@ export interface coreComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -12946,6 +13007,7 @@ export interface coreComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -13154,6 +13216,7 @@ export interface coreComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -13217,6 +13280,7 @@ export interface coreComponents {
     QuoteReissue: {
       /**
        * Date and time when the reissued quote expires.
+       * A new expiration time must be later than the current time.
        * If this field is `null` or omitted, the quote keeps its expiration time when it has not passed.
        * Otherwise, the quote expires one month after it is reissued.
        */
@@ -22591,6 +22655,16 @@ export interface coreComponents {
           /** List of email addresses to send notifications to. */
           notificationEmailAddresses?: string[];
         };
+        /**
+         * Organization sign-in security settings.
+         * This value is read-only on the [Create an organization](https://www.rebilly.com/catalog/all/organizations/postorganization) and [Update an organization](https://www.rebilly.com/catalog/all/organizations/patchorganization) operations.
+         * To change these settings, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+         * To retrieve how many users have multi-factor authentication (MFA) set up, use the [Retrieve security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings) operation.
+         */
+        security?: {
+          /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly app. */
+          requireMfa?: boolean;
+        };
         /**
          * Settings for annual compliance screening of all active customers.
          * When enabled, a compliance screening report is generated for every active customer
@@ -23603,6 +23677,13 @@ export interface coreComponents {
       preferences?: { [key: string]: any } | null;
       /** Specifies if the current user session has permissions emulation enabled. */
       hasPermissionsEmulation?: boolean;
+      /**
+       * Specifies if the user is in an organization in the current environment that requires multi-factor authentication (MFA).
+       * Deactivated organizations are not included.
+       * The requirement is enforced on each request to an organization that requires MFA, regardless of this value.
+       * This value is `false` for API key and service account sessions.
+       */
+      mfaRequiredByOrganization?: boolean;
       /** User's full display name. */
       displayName?: string;
       /** Unique hash value that represents the user. */
@@ -23679,6 +23760,27 @@ export interface coreComponents {
         juniors?: any[];
       };
     };
+    SecuritySettings: {
+      /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
+      requireMfa: boolean;
+      /**
+       * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
+       * Pending invitations are counted as users without MFA.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaAdoption?: {
+        /** Number of active users who have multi-factor authentication (MFA) set up. */
+        enrolled: number;
+        /** Number of active users and pending invitations. */
+        total: number;
+        /**
+         * Number of pending invitations included in `total`.
+         * Invited users must set up multi-factor authentication (MFA) after they accept the invitation.
+         */
+        pending: number;
+      } | null;
+      _links?: coreComponents["schemas"]["SelfLink"];
+    };
     /** Email notification sent through attribution. */
     SendThroughAttribution: {
       eventType?: coreComponents["schemas"]["EventType"];
@@ -23895,6 +23997,14 @@ export interface coreComponents {
        */
       roleIds?: string[];
       allowedIps?: coreComponents["schemas"]["AllowedIps"];
+      /**
+       * Specifies if the user has multi-factor authentication (MFA) set up.
+       * This value is present only in responses from the [Retrieve a list of users](https://www.rebilly.com/catalog/all/users/getusercollection) operation
+       * for an organization that has [security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings),
+       * and is omitted for Rebilly staff.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaEnabled?: boolean | null;
       _links?: coreComponents["schemas"]["SelfLink"];
     };
     WebhookEvent: {
@@ -28567,7 +28677,10 @@ export interface coreComponents {
         "application/json": coreComponents["schemas"]["Unauthorized"];
       };
     };
-    /** Access forbidden. */
+    /**
+     * Access forbidden.
+     * If the organization requires multi-factor authentication (MFA) and the session has not passed MFA, `error` is `mfa_required`.
+     */
     Forbidden: {
       content: {
         "application/json": coreComponents["schemas"]["Forbidden"];
@@ -42752,7 +42865,15 @@ export interface operations {
       429: coreComponents["responses"]["TooManyRequests"];
     };
   };
-  /** Retrieves a list of organizations. */
+  /**
+   * Retrieves a list of organizations.
+   * If an organization requires multi-factor authentication (MFA) and your session has not passed MFA,
+   * the response includes only `id`, `name`, `country`, `features`, `settings.security`, and `_links` for that organization,
+   * and omits all other fields.
+   * In that case, only `id`, `name`, and `features` are available as filter fields,
+   * and only `id` and `name` are available as sort fields.
+   * To require MFA, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+   */
   GetOrganizationCollection: {
     parameters: {
       query: {
@@ -42811,7 +42932,13 @@ export interface operations {
     };
     requestBody: coreComponents["requestBodies"]["PostOrganization"];
   };
-  /** Retrieves an organization with a specified ID. */
+  /**
+   * Retrieves an organization with a specified ID.
+   * If the organization requires multi-factor authentication (MFA) and your session has not passed MFA,
+   * the response includes only `id`, `name`, `country`, `features`, `settings.security`, and `_links`,
+   * and omits all other fields.
+   * To require MFA, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+   */
   GetOrganization: {
     parameters: {
       path: {
@@ -44147,6 +44274,62 @@ export interface operations {
       429: coreComponents["responses"]["TooManyRequests"];
     };
   };
+  /**
+   * Retrieves the sign-in security settings of the organization,
+   * and the number of users who have multi-factor authentication (MFA) set up.
+   * Settings apply to the current environment only: live and sandbox are configured separately.
+   */
+  GetSecuritySettings: {
+    responses: {
+      /** Security settings retrieved. */
+      200: {
+        content: {
+          "application/json": coreComponents["schemas"]["SecuritySettings"];
+        };
+      };
+      401: coreComponents["responses"]["Unauthorized"];
+      403: coreComponents["responses"]["Forbidden"];
+      404: coreComponents["responses"]["NotFound"];
+    };
+  };
+  /**
+   * Updates the sign-in security settings of the organization.
+   * If `requireMfa` is `true`, every user who signs in to the Rebilly UI must pass multi-factor authentication (MFA).
+   * If the session of a user has not passed MFA, other operations respond with `403` and `error` is `mfa_required`.
+   * Only owners and administrators who are signed in to the Rebilly UI can change this setting.
+   * This setting does not apply to API keys, and a request that uses an API key cannot change this setting.
+   * To turn on `requireMfa`, the session must have passed MFA.
+   * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
+   * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+   * Settings apply to the current environment only: live and sandbox are configured separately.
+   */
+  PutSecuritySettings: {
+    responses: {
+      /** Security settings updated. */
+      200: {
+        headers: {};
+        content: {
+          "application/json": coreComponents["schemas"]["SecuritySettings"];
+        };
+      };
+      401: coreComponents["responses"]["Unauthorized"];
+      403: coreComponents["responses"]["Forbidden"];
+      404: coreComponents["responses"]["NotFound"];
+      422: coreComponents["responses"]["ValidationError"];
+      429: coreComponents["responses"]["TooManyRequests"];
+      /** MFA adoption unavailable. */
+      503: {
+        content: {
+          "application/json": coreComponents["schemas"]["Problem"];
+        };
+      };
+    };
+    requestBody: {
+      content: {
+        "application/json": coreComponents["schemas"]["SecuritySettings"];
+      };
+    };
+  };
   /** Retrieves a list of email notifications, that have been sent through attribution, for a specified event type. */
   GetSendThroughAttributionCollection: {
     parameters: {
@@ -44428,7 +44611,19 @@ export interface operations {
       429: coreComponents["responses"]["TooManyRequests"];
     };
   };
-  /** Retrieves a list of users. */
+  /**
+   * Retrieves a list of users.
+   * To retrieve the users of the organization who have multi-factor authentication (MFA) set up,
+   * use `filter=mfaEnabled:true`.
+   * To retrieve the users who do not have MFA set up, including users who have not accepted their invitation,
+   * use `filter=mfaEnabled:false`.
+   * The `mfaEnabled` filter applies only to the list of users of an organization
+   * that has [security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings).
+   * Inactive users and Rebilly staff are not part of the `mfaEnabled` filter.
+   * User objects of Rebilly staff do not include `mfaEnabled`.
+   * The totals are the same as those returned by the [Retrieve security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings) operation.
+   * If the MFA status is temporarily unavailable, the response is `503` and `error` is `mfa_status_unavailable`.
+   */
   GetUserCollection: {
     parameters: {
       query: {
@@ -44467,6 +44662,12 @@ export interface operations {
       };
       401: coreComponents["responses"]["Unauthorized"];
       403: coreComponents["responses"]["Forbidden"];
+      /** MFA status unavailable. */
+      503: {
+        content: {
+          "application/json": coreComponents["schemas"]["Problem"];
+        };
+      };
     };
   };
   /** Creates a user. */
@@ -46154,6 +46355,13 @@ export interface storefrontComponents {
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
+      /**
+       * Message that describes why the request is forbidden.
+       * Most responses use a descriptive message, such as `Not allowed to change security settings`.
+       * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
+       * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       */
+      error?: string;
     } & storefrontComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -52642,6 +52850,7 @@ export interface storefrontComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -52899,6 +53108,7 @@ export interface storefrontComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -53107,6 +53317,7 @@ export interface storefrontComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -53170,6 +53381,7 @@ export interface storefrontComponents {
     QuoteReissue: {
       /**
        * Date and time when the reissued quote expires.
+       * A new expiration time must be later than the current time.
        * If this field is `null` or omitted, the quote keeps its expiration time when it has not passed.
        * Otherwise, the quote expires one month after it is reissued.
        */
@@ -62544,6 +62756,16 @@ export interface storefrontComponents {
           /** List of email addresses to send notifications to. */
           notificationEmailAddresses?: string[];
         };
+        /**
+         * Organization sign-in security settings.
+         * This value is read-only on the [Create an organization](https://www.rebilly.com/catalog/all/organizations/postorganization) and [Update an organization](https://www.rebilly.com/catalog/all/organizations/patchorganization) operations.
+         * To change these settings, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+         * To retrieve how many users have multi-factor authentication (MFA) set up, use the [Retrieve security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings) operation.
+         */
+        security?: {
+          /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly app. */
+          requireMfa?: boolean;
+        };
         /**
          * Settings for annual compliance screening of all active customers.
          * When enabled, a compliance screening report is generated for every active customer
@@ -63556,6 +63778,13 @@ export interface storefrontComponents {
       preferences?: { [key: string]: any } | null;
       /** Specifies if the current user session has permissions emulation enabled. */
       hasPermissionsEmulation?: boolean;
+      /**
+       * Specifies if the user is in an organization in the current environment that requires multi-factor authentication (MFA).
+       * Deactivated organizations are not included.
+       * The requirement is enforced on each request to an organization that requires MFA, regardless of this value.
+       * This value is `false` for API key and service account sessions.
+       */
+      mfaRequiredByOrganization?: boolean;
       /** User's full display name. */
       displayName?: string;
       /** Unique hash value that represents the user. */
@@ -63632,6 +63861,27 @@ export interface storefrontComponents {
         juniors?: any[];
       };
     };
+    SecuritySettings: {
+      /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
+      requireMfa: boolean;
+      /**
+       * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
+       * Pending invitations are counted as users without MFA.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaAdoption?: {
+        /** Number of active users who have multi-factor authentication (MFA) set up. */
+        enrolled: number;
+        /** Number of active users and pending invitations. */
+        total: number;
+        /**
+         * Number of pending invitations included in `total`.
+         * Invited users must set up multi-factor authentication (MFA) after they accept the invitation.
+         */
+        pending: number;
+      } | null;
+      _links?: storefrontComponents["schemas"]["SelfLink"];
+    };
     /** Email notification sent through attribution. */
     SendThroughAttribution: {
       eventType?: storefrontComponents["schemas"]["EventType"];
@@ -63848,6 +64098,14 @@ export interface storefrontComponents {
        */
       roleIds?: string[];
       allowedIps?: storefrontComponents["schemas"]["AllowedIps"];
+      /**
+       * Specifies if the user has multi-factor authentication (MFA) set up.
+       * This value is present only in responses from the [Retrieve a list of users](https://www.rebilly.com/catalog/all/users/getusercollection) operation
+       * for an organization that has [security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings),
+       * and is omitted for Rebilly staff.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaEnabled?: boolean | null;
       _links?: storefrontComponents["schemas"]["SelfLink"];
     };
     WebhookEvent: {
@@ -68520,7 +68778,10 @@ export interface storefrontComponents {
         "application/json": storefrontComponents["schemas"]["Unauthorized"];
       };
     };
-    /** Access forbidden. */
+    /**
+     * Access forbidden.
+     * If the organization requires multi-factor authentication (MFA) and the session has not passed MFA, `error` is `mfa_required`.
+     */
     Forbidden: {
       content: {
         "application/json": storefrontComponents["schemas"]["Forbidden"];
@@ -73435,6 +73696,13 @@ export interface reportsComponents {
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
+      /**
+       * Message that describes why the request is forbidden.
+       * Most responses use a descriptive message, such as `Not allowed to change security settings`.
+       * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
+       * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       */
+      error?: string;
     } & reportsComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -79923,6 +80191,7 @@ export interface reportsComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -80180,6 +80449,7 @@ export interface reportsComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -80388,6 +80658,7 @@ export interface reportsComponents {
       paymentTerms?: string;
       /**
        * Date and time when the quote expires.
+       * A new or updated expiration time must be later than the current time.
        * The default expiration time is one month from the time the quote is issued.
        * In a `draft` state, this field may be `null`.
        */
@@ -80451,6 +80722,7 @@ export interface reportsComponents {
     QuoteReissue: {
       /**
        * Date and time when the reissued quote expires.
+       * A new expiration time must be later than the current time.
        * If this field is `null` or omitted, the quote keeps its expiration time when it has not passed.
        * Otherwise, the quote expires one month after it is reissued.
        */
@@ -89825,6 +90097,16 @@ export interface reportsComponents {
           /** List of email addresses to send notifications to. */
           notificationEmailAddresses?: string[];
         };
+        /**
+         * Organization sign-in security settings.
+         * This value is read-only on the [Create an organization](https://www.rebilly.com/catalog/all/organizations/postorganization) and [Update an organization](https://www.rebilly.com/catalog/all/organizations/patchorganization) operations.
+         * To change these settings, use the [Update security settings](https://www.rebilly.com/catalog/all/organizations/putsecuritysettings) operation.
+         * To retrieve how many users have multi-factor authentication (MFA) set up, use the [Retrieve security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings) operation.
+         */
+        security?: {
+          /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly app. */
+          requireMfa?: boolean;
+        };
         /**
          * Settings for annual compliance screening of all active customers.
          * When enabled, a compliance screening report is generated for every active customer
@@ -90837,6 +91119,13 @@ export interface reportsComponents {
       preferences?: { [key: string]: any } | null;
       /** Specifies if the current user session has permissions emulation enabled. */
       hasPermissionsEmulation?: boolean;
+      /**
+       * Specifies if the user is in an organization in the current environment that requires multi-factor authentication (MFA).
+       * Deactivated organizations are not included.
+       * The requirement is enforced on each request to an organization that requires MFA, regardless of this value.
+       * This value is `false` for API key and service account sessions.
+       */
+      mfaRequiredByOrganization?: boolean;
       /** User's full display name. */
       displayName?: string;
       /** Unique hash value that represents the user. */
@@ -90913,6 +91202,27 @@ export interface reportsComponents {
         juniors?: any[];
       };
     };
+    SecuritySettings: {
+      /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
+      requireMfa: boolean;
+      /**
+       * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
+       * Pending invitations are counted as users without MFA.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaAdoption?: {
+        /** Number of active users who have multi-factor authentication (MFA) set up. */
+        enrolled: number;
+        /** Number of active users and pending invitations. */
+        total: number;
+        /**
+         * Number of pending invitations included in `total`.
+         * Invited users must set up multi-factor authentication (MFA) after they accept the invitation.
+         */
+        pending: number;
+      } | null;
+      _links?: reportsComponents["schemas"]["SelfLink"];
+    };
     /** Email notification sent through attribution. */
     SendThroughAttribution: {
       eventType?: reportsComponents["schemas"]["EventType"];
@@ -91129,6 +91439,14 @@ export interface reportsComponents {
        */
       roleIds?: string[];
       allowedIps?: reportsComponents["schemas"]["AllowedIps"];
+      /**
+       * Specifies if the user has multi-factor authentication (MFA) set up.
+       * This value is present only in responses from the [Retrieve a list of users](https://www.rebilly.com/catalog/all/users/getusercollection) operation
+       * for an organization that has [security settings](https://www.rebilly.com/catalog/all/organizations/getsecuritysettings),
+       * and is omitted for Rebilly staff.
+       * This value is `null` when this information is temporarily unavailable.
+       */
+      mfaEnabled?: boolean | null;
       _links?: reportsComponents["schemas"]["SelfLink"];
     };
     WebhookEvent: {
@@ -95801,7 +96119,10 @@ export interface reportsComponents {
         "application/json": reportsComponents["schemas"]["Unauthorized"];
       };
     };
-    /** Access forbidden. */
+    /**
+     * Access forbidden.
+     * If the organization requires multi-factor authentication (MFA) and the session has not passed MFA, `error` is `mfa_required`.
+     */
     Forbidden: {
       content: {
         "application/json": reportsComponents["schemas"]["Forbidden"];
@@ -101504,6 +101825,11 @@ declare module "rebilly-js-sdk" {
     export type PutRoleResponsePromise = rebilly.PutRoleResponsePromise;
     export type DeleteRoleResponse = rebilly.DeleteRoleResponse;
     export type DeleteRoleResponsePromise = rebilly.DeleteRoleResponsePromise;
+    export type GetSecuritySettingsResponse = rebilly.GetSecuritySettingsResponse;
+    export type GetSecuritySettingsResponsePromise = rebilly.GetSecuritySettingsResponsePromise;
+    export type PutSecuritySettingsRequest = rebilly.PutSecuritySettingsRequest;
+    export type PutSecuritySettingsResponse = rebilly.PutSecuritySettingsResponse;
+    export type PutSecuritySettingsResponsePromise = rebilly.PutSecuritySettingsResponsePromise;
     export type GetSendThroughAttributionCollectionRequest = rebilly.GetSendThroughAttributionCollectionRequest;
     export type GetSendThroughAttributionCollectionResponse = rebilly.GetSendThroughAttributionCollectionResponse;
     export type GetSendThroughAttributionCollectionResponsePromise = rebilly.GetSendThroughAttributionCollectionResponsePromise;
@@ -102102,6 +102428,7 @@ declare module "errors/errors" {
     namespace Errors {
         export { RebillyError };
         export { RebillyRequestError };
+        export { RebillyMfaRequiredError };
         export { RebillyValidationError };
         export { RebillyNotFoundError };
         export { RebillyConflictError };
@@ -102114,6 +102441,9 @@ declare module "errors/errors" {
     class RebillyRequestError extends RebillyError {
         constructor(error: any);
     }
+    class RebillyMfaRequiredError extends RebillyRequestError {
+        name: string;
+    }
     class RebillyValidationError extends RebillyError {
         constructor(error: any);
     }
@@ -103771,6 +104101,16 @@ declare module "resources/search-resource" {
         }): rebilly.GetSearchResponsePromise;
     };
 }
+declare module "resources/security-settings-resource" {
+    export default function SecuritySettingsResource({ apiHandler }: {
+        apiHandler: any;
+    }): {
+        get(): rebilly.GetSecuritySettingsResponsePromise;
+        update({ data }: {
+            data: any;
+        }): rebilly.PutSecuritySettingsResponsePromise;
+    };
+}
 declare module "resources/segments-resource" {
     export default function SegmentsResource({ apiHandler }: {
         apiHandler: any;
@@ -105495,6 +105835,12 @@ declare module "resources/api-instance" {
                 q?: any;
             }): rebilly.GetSearchResponsePromise;
         };
+        securitySettings: {
+            get(): rebilly.GetSecuritySettingsResponsePromise;
+            update({ data }: {
+                data: any;
+            }): rebilly.PutSecuritySettingsResponsePromise;
+        };
         segments: {
             getAll({ limit, offset, sort, filter, q, }?: rebilly.GetGridSegmentCollectionRequest): rebilly.GetGridSegmentCollectionResponsePromise;
             create({ id, data }: rebilly.CreateGridSegmentRequest): rebilly.PostGridSegmentResponsePromise;