rebilly-js-sdk 62.235.1 → 62.236.0

package/CHANGELOG.md

@@ -1,5 +1,5 @@
-## 62.235.1 (2026-10-26)
+## 62.236.0 (2026-10-26)
 
-### 🧱 Updated Dependencies
+### Features
 
-- Updated eslint-config to 4.32.14
+- **be,recomm:** add an organization IP allowlist ([#29914](https://github.com/Rebilly/rebilly/pull/29914))

package/dist/rebilly-js-sdk.d.cts

@@ -4627,7 +4627,12 @@ export interface corePaths {
   "/api-keys": {
     /** Retrieve a list of API keys. */
     get: operations["GetApiKeyCollection"];
-    /** Create an API key. */
+    /**
+     * Creates an API key for the authenticated user.
+     * The key is not assigned to another user.
+     * If the authenticated user is removed from an organization, a request to that organization that uses the API key is not authorized.
+     * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
+     */
     post: operations["PostApiKey"];
   };
   "/api-keys/{id}": {
@@ -5746,6 +5751,9 @@ export interface corePaths {
      * To turn on `requireMfa`, the session must have passed MFA.
      * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
      * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+     * If `allowedIps` contains IP addresses, users can use the organization in the Rebilly UI only from those IP addresses.
+     * If a request comes from another IP address, other operations respond with `403` and `error` is `ip_not_allowed`.
+     * If the list does not include the IP address of the caller, the response is `422`.
      * Settings apply to the current environment only: live and sandbox are configured separately.
      */
     put: operations["PutSecuritySettings"];
@@ -6278,6 +6286,12 @@ export interface coreComponents {
       /** HTTP status code. */
       status?: number;
     } & coreComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -6286,8 +6300,15 @@ export interface coreComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: coreComponents["schemas"]["OrganizationId"];
     } & coreComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -7543,12 +7564,6 @@ export interface coreComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -16008,8 +16023,14 @@ export interface coreComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: coreComponents["schemas"]["Acl"];
       allowedIps?: coreComponents["schemas"]["AllowedIps"];
@@ -23900,6 +23921,21 @@ export interface coreComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: coreComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -39999,7 +40035,12 @@ export interface operations {
       403: coreComponents["responses"]["Forbidden"];
     };
   };
-  /** Create an API key. */
+  /**
+   * Creates an API key for the authenticated user.
+   * The key is not assigned to another user.
+   * If the authenticated user is removed from an organization, a request to that organization that uses the API key is not authorized.
+   * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
+   */
   PostApiKey: {
     responses: {
       /** API key created. */
@@ -44538,6 +44579,9 @@ export interface operations {
    * To turn on `requireMfa`, the session must have passed MFA.
    * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
    * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+   * If `allowedIps` contains IP addresses, users can use the organization in the Rebilly UI only from those IP addresses.
+   * If a request comes from another IP address, other operations respond with `403` and `error` is `ip_not_allowed`.
+   * If the list does not include the IP address of the caller, the response is `422`.
    * Settings apply to the current environment only: live and sandbox are configured separately.
    */
   PutSecuritySettings: {
@@ -46602,6 +46646,12 @@ export interface storefrontComponents {
       /** HTTP status code. */
       status?: number;
     } & storefrontComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -46610,8 +46660,15 @@ export interface storefrontComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: storefrontComponents["schemas"]["OrganizationId"];
     } & storefrontComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -47867,12 +47924,6 @@ export interface storefrontComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -56332,8 +56383,14 @@ export interface storefrontComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: storefrontComponents["schemas"]["Acl"];
       allowedIps?: storefrontComponents["schemas"]["AllowedIps"];
@@ -64224,6 +64281,21 @@ export interface storefrontComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: storefrontComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -74166,6 +74238,12 @@ export interface reportsComponents {
       /** HTTP status code. */
       status?: number;
     } & reportsComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -74174,8 +74252,15 @@ export interface reportsComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: reportsComponents["schemas"]["OrganizationId"];
     } & reportsComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -75431,12 +75516,6 @@ export interface reportsComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -83896,8 +83975,14 @@ export interface reportsComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: reportsComponents["schemas"]["Acl"];
       allowedIps?: reportsComponents["schemas"]["AllowedIps"];
@@ -91788,6 +91873,21 @@ export interface reportsComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: reportsComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -103092,6 +103192,7 @@ declare module "errors/errors" {
         export { RebillyError };
         export { RebillyRequestError };
         export { RebillyMfaRequiredError };
+        export { RebillyIpNotAllowedError };
         export { RebillyValidationError };
         export { RebillyNotFoundError };
         export { RebillyConflictError };
@@ -103107,6 +103208,9 @@ declare module "errors/errors" {
     class RebillyMfaRequiredError extends RebillyRequestError {
         name: string;
     }
+    class RebillyIpNotAllowedError extends RebillyRequestError {
+        name: string;
+    }
     class RebillyValidationError extends RebillyError {
         constructor(error: any);
     }

package/dist/rebilly-js-sdk.d.mts

@@ -4627,7 +4627,12 @@ export interface corePaths {
   "/api-keys": {
     /** Retrieve a list of API keys. */
     get: operations["GetApiKeyCollection"];
-    /** Create an API key. */
+    /**
+     * Creates an API key for the authenticated user.
+     * The key is not assigned to another user.
+     * If the authenticated user is removed from an organization, a request to that organization that uses the API key is not authorized.
+     * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
+     */
     post: operations["PostApiKey"];
   };
   "/api-keys/{id}": {
@@ -5746,6 +5751,9 @@ export interface corePaths {
      * To turn on `requireMfa`, the session must have passed MFA.
      * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
      * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+     * If `allowedIps` contains IP addresses, users can use the organization in the Rebilly UI only from those IP addresses.
+     * If a request comes from another IP address, other operations respond with `403` and `error` is `ip_not_allowed`.
+     * If the list does not include the IP address of the caller, the response is `422`.
      * Settings apply to the current environment only: live and sandbox are configured separately.
      */
     put: operations["PutSecuritySettings"];
@@ -6278,6 +6286,12 @@ export interface coreComponents {
       /** HTTP status code. */
       status?: number;
     } & coreComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -6286,8 +6300,15 @@ export interface coreComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: coreComponents["schemas"]["OrganizationId"];
     } & coreComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -7543,12 +7564,6 @@ export interface coreComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -16008,8 +16023,14 @@ export interface coreComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: coreComponents["schemas"]["Acl"];
       allowedIps?: coreComponents["schemas"]["AllowedIps"];
@@ -23900,6 +23921,21 @@ export interface coreComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: coreComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -39999,7 +40035,12 @@ export interface operations {
       403: coreComponents["responses"]["Forbidden"];
     };
   };
-  /** Create an API key. */
+  /**
+   * Creates an API key for the authenticated user.
+   * The key is not assigned to another user.
+   * If the authenticated user is removed from an organization, a request to that organization that uses the API key is not authorized.
+   * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
+   */
   PostApiKey: {
     responses: {
       /** API key created. */
@@ -44538,6 +44579,9 @@ export interface operations {
    * To turn on `requireMfa`, the session must have passed MFA.
    * If the session has not passed MFA, the response is `403` and `error` is `mfa_required_for_caller`.
    * If the number of users who have MFA set up is temporarily unavailable, `requireMfa` cannot be turned on and the response is `503`.
+   * If `allowedIps` contains IP addresses, users can use the organization in the Rebilly UI only from those IP addresses.
+   * If a request comes from another IP address, other operations respond with `403` and `error` is `ip_not_allowed`.
+   * If the list does not include the IP address of the caller, the response is `422`.
    * Settings apply to the current environment only: live and sandbox are configured separately.
    */
   PutSecuritySettings: {
@@ -46602,6 +46646,12 @@ export interface storefrontComponents {
       /** HTTP status code. */
       status?: number;
     } & storefrontComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -46610,8 +46660,15 @@ export interface storefrontComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: storefrontComponents["schemas"]["OrganizationId"];
     } & storefrontComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -47867,12 +47924,6 @@ export interface storefrontComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -56332,8 +56383,14 @@ export interface storefrontComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: storefrontComponents["schemas"]["Acl"];
       allowedIps?: storefrontComponents["schemas"]["AllowedIps"];
@@ -64224,6 +64281,21 @@ export interface storefrontComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: storefrontComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -74166,6 +74238,12 @@ export interface reportsComponents {
       /** HTTP status code. */
       status?: number;
     } & reportsComponents["schemas"]["BaseProblem"];
+    /**
+     * Unique organization identifier.
+     * An organization is an entity that represents a company.
+     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
+     */
+    OrganizationId: string;
     Forbidden: { [key: string]: any } & {
       /** HTTP status code. */
       status?: number;
@@ -74174,8 +74252,15 @@ export interface reportsComponents {
        * Most responses use a descriptive message, such as `Not allowed to change security settings`.
        * If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
        * If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.
+       * If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
        */
       error?: string;
+      /**
+       * ID of the organization that does not allow the IP address of the request.
+       * This property is present only if `error` is `ip_not_allowed`.
+       * The organization is the organization of the request or another organization that the request acts on.
+       */
+      organizationId?: reportsComponents["schemas"]["OrganizationId"];
     } & reportsComponents["schemas"]["BaseProblem"];
     NotFound: {
       /** HTTP status code. */
@@ -75431,12 +75516,6 @@ export interface reportsComponents {
       /** Revenue amount in USD. */
       amountUsd?: number;
     };
-    /**
-     * Unique organization identifier.
-     * An organization is an entity that represents a company.
-     * For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
-     */
-    OrganizationId: string;
     TaxNumber: {
       /** Type of the tax number. */
       type: "eu-vat" | "other";
@@ -83896,8 +83975,14 @@ export interface reportsComponents {
       /** Type of API key. */
       type?: "secret" | "publishable";
       /**
-       * Specify access control list here if creating a restricted API key.
-       * Send all matching permission with an empty scope to allow all permissions.
+       * Permissions for this API key.
+       *
+       * A request is authorized only when these permissions include the permission for the operation,
+       * and the associated user has that permission.
+       * If these permissions include `*`, each operation is limited to the permissions of the associated user.
+       * If the associated user loses a permission and these permissions still include that permission, a request that requires that permission is not authorized.
+       * If the associated user gains a permission, a request that requires that permission is authorized only when these permissions include that permission or `*`.
+       * For more information, see [Ownership of an API key](https://www.rebilly.com/docs/dev-docs/api-keys/#ownership-of-an-api-key).
        */
       acl?: reportsComponents["schemas"]["Acl"];
       allowedIps?: reportsComponents["schemas"]["AllowedIps"];
@@ -91788,6 +91873,21 @@ export interface reportsComponents {
     SecuritySettings: {
       /** Specifies if users must pass multi-factor authentication (MFA) to use this organization in the Rebilly UI. */
       requireMfa: boolean;
+      /**
+       * List of IP addresses and Classless Inter-Domain Routing (CIDR) ranges from which users can use this organization in the Rebilly UI.
+       * This setting does not apply to API keys.
+       * This setting applies to the current environment only: live and sandbox are configured separately.
+       * If an IP address has no prefix length, only that address is allowed.
+       * Wildcards, such as `198.51.*.*`, are not accepted.
+       * To remove the restriction, set this value to `null` or an empty array.
+       * To retain the current list, omit this property.
+       */
+      allowedIps?: reportsComponents["schemas"]["AllowedIps"];
+      /**
+       * IP address of the client that sent the request.
+       * This value is `null` if the IP address of the client cannot be determined.
+       */
+      currentIpAddress?: string | null;
       /**
        * Number of users who have set up multi-factor authentication (MFA), excluding Rebilly staff.
        * Pending invitations are counted as users without MFA.
@@ -103092,6 +103192,7 @@ declare module "errors/errors" {
         export { RebillyError };
         export { RebillyRequestError };
         export { RebillyMfaRequiredError };
+        export { RebillyIpNotAllowedError };
         export { RebillyValidationError };
         export { RebillyNotFoundError };
         export { RebillyConflictError };
@@ -103107,6 +103208,9 @@ declare module "errors/errors" {
     class RebillyMfaRequiredError extends RebillyRequestError {
         name: string;
     }
+    class RebillyIpNotAllowedError extends RebillyRequestError {
+        name: string;
+    }
     class RebillyValidationError extends RebillyError {
         constructor(error: any);
     }