authpi-admin 0.3.0__tar.gz → 0.8.0__tar.gz

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/.gitignore

@@ -13,6 +13,7 @@ vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 oracle.sql
 dist
+dist-templates/
 storybook-static
 target
 filter/
@@ -29,6 +30,7 @@ test-adyen/
 stripe-authpi/
 stripe-app/
 secrets.json
+*.secrets.json
 .idea
 .vscode
 *.pem
@@ -49,3 +51,10 @@ worker-configuration.d.ts
 .worktrees/
 docs/plans/
 docs/superpowers/
+docs/.obsidian/
+
+# Operator-rendered ops-db bootstrap files — carry environment-specific
+# captured `agt_*` IDs from the Step 3 bootstrap. The .template stays in
+# git as the canonical structure; rendered copies stay local.
+d1-databases/ops-db/0005_bootstrap_capability_matrix.sql
+d1-databases/ops-db/0005_bootstrap_capability_matrix_prod.sql

authpi_admin-0.8.0/CHANGELOG.md

@@ -0,0 +1,78 @@
+# Changelog
+
+## [0.8.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.7.0...authpi-admin-v0.8.0) (2026-06-21)
+
+
+### Features
+
+* **admin-py:** release public SDK types module ([20a8329](https://github.com/arbfay/authpi/commit/20a8329e8ddda0923a8dfd7e8d2380c060ea3f42))
+
+## [0.7.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.6.0...authpi-admin-v0.7.0) (2026-06-12)
+
+
+### Features
+
+* GET /v1/me — caller identity endpoint (AUT-163) ([#286](https://github.com/arbfay/authpi/issues/286)) ([b9f35dc](https://github.com/arbfay/authpi/commit/b9f35dc2fd8cca77cdd2079b240ce28dc11d35a8))
+
+## [0.6.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.4.0...authpi-admin-v0.6.0) (2026-06-11)
+
+
+### ⚠ BREAKING CHANGES
+
+* **admin-py:** collision-split class renames (see admin-ts) and issuer-scope org-subresource accessors moved to the organization scope; the removed accessors 404'd on every call, so no working integration is affected.
+* **admin-ts:** cross-scope name collisions split generated classes (ApiKeysResource -> AccountApiKeysResource, TokensResource -> AccountTokensResource, SessionsResource -> IssuerSessionsResource / UserSessionsResource, VerifiersResource -> AgentVerifiersResource / UserVerifiersResource), and the issuer-scope groups/invitations/ members/domains accessors moved to the new organization scope. The removed accessors produced 404s on every call, so no working integration is affected.
+
+### Features
+
+* **admin-py:** regenerate from corrected spec — org scope, restored endpoints, credits ([2cd96b5](https://github.com/arbfay/authpi/commit/2cd96b569ab9ddff8589fd8e786a16052af4c7e5))
+* **admin-ts:** regenerate from corrected spec — org scope, restored endpoints, credits ([3932b60](https://github.com/arbfay/authpi/commit/3932b609116f059dff36a73f9a5378c21d69eb3d))
+
+
+### Bug Fixes
+
+* **generators:** action methods carry query params and real response types ([0f515ec](https://github.com/arbfay/authpi/commit/0f515ecc1ce737f62e2826ff3106b97c35a6ce2f))
+
+## [0.4.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.3.1...authpi-admin-v0.4.0) (2026-06-11)
+
+
+### ⚠ BREAKING CHANGES
+
+* **admin-py:** `account_id` is now required for both auth modes. The api_key-without-account_id form never produced a successful request.
+* **admin-py:** `api_key` changed from `str` to `tuple[str, str]`. The previous form never authenticated successfully, so no working integration is affected.
+
+### Bug Fixes
+
+* **admin-py:** default base_url to the production API ([4351942](https://github.com/arbfay/authpi/commit/4351942f3c40d75b24e079e1d83553e6f58a3303))
+* **admin-py:** require account_id — the API has no accounts/me alias ([58cf3a2](https://github.com/arbfay/authpi/commit/58cf3a2a1af402f7b9e20ceadd84e6015957f000))
+* **admin-py:** send API keys as HTTP Basic id:secret pair ([aee64f7](https://github.com/arbfay/authpi/commit/aee64f777abb18ecb4578c178cf55a4c72abb046))
+
+## [0.3.1](https://github.com/arbfay/authpi/compare/authpi-admin-v0.3.0...authpi-admin-v0.3.1) (2026-06-10)
+
+
+### Bug Fixes
+
+* **admin-py:** unwrap the single-resource data envelope in generated methods ([d63ee44](https://github.com/arbfay/authpi/commit/d63ee44d9db64e46dbfbfc5da66c4a1aaeacf609))
+
+## [0.3.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.2.0...authpi-admin-v0.3.0) (2026-04-17)
+
+
+### Features
+
+* **sdks:** set custom User-Agent for SDK identification ([#213](https://github.com/arbfay/authpi/issues/213)) ([dec716c](https://github.com/arbfay/authpi/commit/dec716c99d877e99496f45c69f3625341bb2bc2e))
+
+## [0.2.0](https://github.com/arbfay/authpi/compare/authpi-admin-v0.1.0...authpi-admin-v0.2.0) (2026-04-13)
+
+
+### ⚠ BREAKING CHANGES
+
+* All generated type interfaces now use snake_case field names. Consumers referencing camelCase fields (e.g., Client.issuerId) must update to snake_case (Client.issuer_id).
+
+### Features
+
+* Admin SDK code generator + Python SDK (authpi-admin) ([#186](https://github.com/arbfay/authpi/issues/186)) ([3eb5055](https://github.com/arbfay/authpi/commit/3eb505579f34a49769e0b01eb59f6d571ad74571))
+* SDK convergence — extend @authpi/admin, migrate console, security fixes ([#197](https://github.com/arbfay/authpi/issues/197)) ([3d4896f](https://github.com/arbfay/authpi/commit/3d4896fa60381542d99a66e394809d128bf6bcf0))
+
+
+### Bug Fixes
+
+* **admin:** fix custom action paths, security hardening for TS and Python SDKs ([#189](https://github.com/arbfay/authpi/issues/189)) ([bf5e0b4](https://github.com/arbfay/authpi/commit/bf5e0b430a76173a1a1b4ff188095a96b337a74c))

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: authpi-admin
-Version: 0.3.0
+Version: 0.8.0
 Summary: Official Python Admin SDK for AuthPI Core API
 Project-URL: Homepage, https://authpi.com
 Project-URL: Documentation, https://docs.authpi.com/sdk/python/admin
@@ -46,8 +46,9 @@ pip install authpi-admin
 
 ```python
 from authpi_admin import AuthPIAdmin
+from authpi_admin.types import WebhookEventType
 
-async with AuthPIAdmin(api_key="key_xxx") as admin:
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx") as admin:
     # List issuers
     page = await admin.issuers.list(limit=10)
     print(page.data)
@@ -64,14 +65,41 @@ async with AuthPIAdmin(api_key="key_xxx") as admin:
         "email": "alice@example.com",
         "display_name": "Alice",
     })
+
+    # Create a webhook with typed event subscriptions
+    webhook = await admin.webhooks.create({
+        "name": "Lifecycle events",
+        "url": "https://example.com/webhooks/authpi",
+        "auth": {"type": "signature"},
+        "events": [
+            WebhookEventType.ORGANIZATION_CREATED,
+            WebhookEventType.USER_CREATED,
+        ],
+    })
+```
+
+Generated response models, request `TypedDict`s, and enums are exported from `authpi_admin.types`. Most calls can use dict literals directly; import request types only when you want to annotate a reusable payload:
+
+```python
+from authpi_admin.types import CreateWebhookInput, WebhookEventType
+
+payload: CreateWebhookInput = {
+    "name": "Lifecycle events",
+    "url": "https://example.com/webhooks/authpi",
+    "auth": {"type": "signature"},
+    "events": [WebhookEventType.USER_CREATED],
+}
+await admin.webhooks.create(payload)
 ```
 
 ## Authentication
 
 ### API Key (default)
 
+API keys are issued as an **id + secret pair** — both parts are shown once when you create the key in the dashboard. The SDK sends them as HTTP Basic credentials (`key_id:key_secret`):
+
 ```python
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 ```
 
 ### Bearer Token
@@ -101,6 +129,24 @@ admin = AuthPIAdmin(
 
 When `on_token_expired` is provided, the SDK calls it on 401 responses and retries the request with the new token. Concurrent 401s are deduplicated — only one refresh runs at a time.
 
+### Account resolution
+
+`account_id` is optional. When omitted, the SDK resolves it once via `GET /v1/me` on the first request and caches it — an API key always maps to exactly one account:
+
+```python
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret")) as admin:
+    issuers = await admin.issuers.list()  # resolves the account transparently
+```
+
+If the credential can act on zero or multiple accounts (possible with user bearer tokens), the SDK raises a `ConfigurationError` naming the choices — pass `account_id` explicitly in that case.
+
+You can also ask directly who the API considers you to be:
+
+```python
+me = await admin.whoami()
+# {"type": "api_key", "key_id": "key_...", "issuer_id": "i_...", "accounts": [{"account_id": ..., "org_id": ..., "scopes": [...]}]}
+```
+
 ## Scoped Client Pattern
 
 The SDK mirrors the API's resource hierarchy. Navigate with chained accessors:
@@ -108,7 +154,12 @@ The SDK mirrors the API's resource hierarchy. Navigate with chained accessors:
 ```python
 # Account-level resources
 await admin.issuers.list()
-await admin.webhooks.create({"url": "https://..."})
+await admin.webhooks.create({
+    "name": "Lifecycle events",
+    "url": "https://...",
+    "auth": {"type": "signature"},
+    "events": [WebhookEventType.USER_CREATED],
+})
 await admin.events.list(limit=50)
 
 # Issuer scope
@@ -119,6 +170,10 @@ await iss.clients.list()
 await iss.organizations.list()
 
 # User scope (nested under issuer)
+org = admin.issuer("iss_xxx").organization("org_xxx")
+await org.members.list()
+await org.sso.add_domain(domain="acme.com")
+
 usr = admin.issuer("iss_xxx").user("usr_xxx")
 await usr.get()
 await usr.sessions.list()
@@ -160,14 +215,15 @@ Read-only requests (GET, HEAD, OPTIONS) are automatically retried on 429, 502, 5
 
 ```python
 # Default: retries enabled (3 attempts, 1s base delay, exponential backoff)
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 
 # Disable retries
-admin = AuthPIAdmin(api_key="key_xxx", retries=False)
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), retries=False)
 
 # Custom retry config
 admin = AuthPIAdmin(
-    api_key="key_xxx",
+    api_key=("key_xxx", "your_key_secret"),
+    account_id="acc_xxx",
     retries={"limit": 5, "delay": 0.5, "backoff": "linear"},
 )
 ```
@@ -239,8 +295,9 @@ except AuthenticationError:
 from authpi_admin import AuthPIAdmin
 
 admin = AuthPIAdmin(
-    api_key="key_xxx",                          # or access_token + account_id
-    base_url="https://api.authpi.dev",          # default
+    api_key=("key_xxx", "your_key_secret"),     # or access_token instead
+    account_id="acc_xxx",                       # optional — resolved via GET /v1/me when omitted
+    base_url="https://api.authpi.com",          # default
     timeout=30.0,                               # default, in seconds
     default_headers={"X-Custom": "value"},      # optional extra headers
     retries=True,                               # default (or False, or dict)
@@ -256,7 +313,7 @@ import httpx
 from authpi_admin import AuthPIAdmin
 
 async with httpx.AsyncClient(proxies="http://proxy:8080") as http:
-    admin = AuthPIAdmin(api_key="key_xxx", http_client=http)
+    admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), http_client=http)
     await admin.issuers.list()
 ```
 
@@ -265,7 +322,7 @@ async with httpx.AsyncClient(proxies="http://proxy:8080") as http:
 The SDK supports async context managers for clean resource cleanup:
 
 ```python
-async with AuthPIAdmin(api_key="key_xxx") as admin:
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx") as admin:
     await admin.issuers.list()
 # httpx client is closed automatically
 ```
@@ -273,7 +330,7 @@ async with AuthPIAdmin(api_key="key_xxx") as admin:
 Or close manually:
 
 ```python
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 try:
     await admin.issuers.list()
 finally:

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/README.md

@@ -14,8 +14,9 @@ pip install authpi-admin
 
 ```python
 from authpi_admin import AuthPIAdmin
+from authpi_admin.types import WebhookEventType
 
-async with AuthPIAdmin(api_key="key_xxx") as admin:
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx") as admin:
     # List issuers
     page = await admin.issuers.list(limit=10)
     print(page.data)
@@ -32,14 +33,41 @@ async with AuthPIAdmin(api_key="key_xxx") as admin:
         "email": "alice@example.com",
         "display_name": "Alice",
     })
+
+    # Create a webhook with typed event subscriptions
+    webhook = await admin.webhooks.create({
+        "name": "Lifecycle events",
+        "url": "https://example.com/webhooks/authpi",
+        "auth": {"type": "signature"},
+        "events": [
+            WebhookEventType.ORGANIZATION_CREATED,
+            WebhookEventType.USER_CREATED,
+        ],
+    })
+```
+
+Generated response models, request `TypedDict`s, and enums are exported from `authpi_admin.types`. Most calls can use dict literals directly; import request types only when you want to annotate a reusable payload:
+
+```python
+from authpi_admin.types import CreateWebhookInput, WebhookEventType
+
+payload: CreateWebhookInput = {
+    "name": "Lifecycle events",
+    "url": "https://example.com/webhooks/authpi",
+    "auth": {"type": "signature"},
+    "events": [WebhookEventType.USER_CREATED],
+}
+await admin.webhooks.create(payload)
 ```
 
 ## Authentication
 
 ### API Key (default)
 
+API keys are issued as an **id + secret pair** — both parts are shown once when you create the key in the dashboard. The SDK sends them as HTTP Basic credentials (`key_id:key_secret`):
+
 ```python
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 ```
 
 ### Bearer Token
@@ -69,6 +97,24 @@ admin = AuthPIAdmin(
 
 When `on_token_expired` is provided, the SDK calls it on 401 responses and retries the request with the new token. Concurrent 401s are deduplicated — only one refresh runs at a time.
 
+### Account resolution
+
+`account_id` is optional. When omitted, the SDK resolves it once via `GET /v1/me` on the first request and caches it — an API key always maps to exactly one account:
+
+```python
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret")) as admin:
+    issuers = await admin.issuers.list()  # resolves the account transparently
+```
+
+If the credential can act on zero or multiple accounts (possible with user bearer tokens), the SDK raises a `ConfigurationError` naming the choices — pass `account_id` explicitly in that case.
+
+You can also ask directly who the API considers you to be:
+
+```python
+me = await admin.whoami()
+# {"type": "api_key", "key_id": "key_...", "issuer_id": "i_...", "accounts": [{"account_id": ..., "org_id": ..., "scopes": [...]}]}
+```
+
 ## Scoped Client Pattern
 
 The SDK mirrors the API's resource hierarchy. Navigate with chained accessors:
@@ -76,7 +122,12 @@ The SDK mirrors the API's resource hierarchy. Navigate with chained accessors:
 ```python
 # Account-level resources
 await admin.issuers.list()
-await admin.webhooks.create({"url": "https://..."})
+await admin.webhooks.create({
+    "name": "Lifecycle events",
+    "url": "https://...",
+    "auth": {"type": "signature"},
+    "events": [WebhookEventType.USER_CREATED],
+})
 await admin.events.list(limit=50)
 
 # Issuer scope
@@ -87,6 +138,10 @@ await iss.clients.list()
 await iss.organizations.list()
 
 # User scope (nested under issuer)
+org = admin.issuer("iss_xxx").organization("org_xxx")
+await org.members.list()
+await org.sso.add_domain(domain="acme.com")
+
 usr = admin.issuer("iss_xxx").user("usr_xxx")
 await usr.get()
 await usr.sessions.list()
@@ -128,14 +183,15 @@ Read-only requests (GET, HEAD, OPTIONS) are automatically retried on 429, 502, 5
 
 ```python
 # Default: retries enabled (3 attempts, 1s base delay, exponential backoff)
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 
 # Disable retries
-admin = AuthPIAdmin(api_key="key_xxx", retries=False)
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), retries=False)
 
 # Custom retry config
 admin = AuthPIAdmin(
-    api_key="key_xxx",
+    api_key=("key_xxx", "your_key_secret"),
+    account_id="acc_xxx",
     retries={"limit": 5, "delay": 0.5, "backoff": "linear"},
 )
 ```
@@ -207,8 +263,9 @@ except AuthenticationError:
 from authpi_admin import AuthPIAdmin
 
 admin = AuthPIAdmin(
-    api_key="key_xxx",                          # or access_token + account_id
-    base_url="https://api.authpi.dev",          # default
+    api_key=("key_xxx", "your_key_secret"),     # or access_token instead
+    account_id="acc_xxx",                       # optional — resolved via GET /v1/me when omitted
+    base_url="https://api.authpi.com",          # default
     timeout=30.0,                               # default, in seconds
     default_headers={"X-Custom": "value"},      # optional extra headers
     retries=True,                               # default (or False, or dict)
@@ -224,7 +281,7 @@ import httpx
 from authpi_admin import AuthPIAdmin
 
 async with httpx.AsyncClient(proxies="http://proxy:8080") as http:
-    admin = AuthPIAdmin(api_key="key_xxx", http_client=http)
+    admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), http_client=http)
     await admin.issuers.list()
 ```
 
@@ -233,7 +290,7 @@ async with httpx.AsyncClient(proxies="http://proxy:8080") as http:
 The SDK supports async context managers for clean resource cleanup:
 
 ```python
-async with AuthPIAdmin(api_key="key_xxx") as admin:
+async with AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx") as admin:
     await admin.issuers.list()
 # httpx client is closed automatically
 ```
@@ -241,7 +298,7 @@ async with AuthPIAdmin(api_key="key_xxx") as admin:
 Or close manually:
 
 ```python
-admin = AuthPIAdmin(api_key="key_xxx")
+admin = AuthPIAdmin(api_key=("key_xxx", "your_key_secret"), account_id="acc_xxx")
 try:
     await admin.issuers.list()
 finally:

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/authpi_admin/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.3.0"
+__version__ = "0.8.0"
 
 from authpi_admin.client import AuthPIAdmin
 from authpi_admin.errors import (
@@ -23,11 +23,12 @@ from authpi_admin.errors import (
     UnexpectedError,
     ValidationError,
 )
+from authpi_admin.generated.scopes.agent_scope import AgentScope
 from authpi_admin.generated.scopes.issuer_scope import IssuerScope
 from authpi_admin.generated.scopes.user_scope import UserScope
-from authpi_admin.generated.scopes.agent_scope import AgentScope
 from authpi_admin.generated.scopes.webhook_scope import WebhookScope
 from authpi_admin.pagination import Page
+from authpi_admin.types import WebhookEventType
 
 __all__ = [
     "AgentScope",
@@ -51,5 +52,6 @@ __all__ = [
     "UnexpectedError",
     "UserScope",
     "ValidationError",
+    "WebhookEventType",
     "WebhookScope",
 ]

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/authpi_admin/_version.py

@@ -1,5 +1,5 @@
 """SDK version — kept in sync with pyproject.toml via release-please."""
 
 # x-release-please-start-version
-SDK_VERSION = "0.3.0"
+SDK_VERSION = "0.8.0"
 # x-release-please-end

{authpi_admin-0.3.0 → authpi_admin-0.8.0}/authpi_admin/client.py

@@ -2,23 +2,25 @@
 
 from __future__ import annotations
 
+from collections.abc import Awaitable, Callable
 from functools import cached_property
-from typing import TYPE_CHECKING, Any, Awaitable, Callable
+from typing import TYPE_CHECKING, Any
 
 import httpx
 
 from authpi_admin.errors import ConfigurationError
-from authpi_admin.http_client import HttpClient
+from authpi_admin.generated.resources.account_api_keys import AccountApiKeysResource
+from authpi_admin.generated.resources.account_tokens import AccountTokensResource
 from authpi_admin.generated.resources.accounts import AccountsResource
-from authpi_admin.generated.resources.api_keys import ApiKeysResource
+from authpi_admin.generated.resources.credits import CreditsResource
 from authpi_admin.generated.resources.domains import DomainsResource
 from authpi_admin.generated.resources.events import EventsResource
 from authpi_admin.generated.resources.issuers import IssuersResource
 from authpi_admin.generated.resources.notes import NotesResource
-from authpi_admin.generated.resources.tokens import TokensResource
 from authpi_admin.generated.resources.webhooks import WebhooksResource
 from authpi_admin.generated.scopes.issuer_scope import IssuerScope
 from authpi_admin.generated.scopes.webhook_scope import WebhookScope
+from authpi_admin.http_client import UNRESOLVED_ACCOUNT_ID, HttpClient
 
 if TYPE_CHECKING:
     from types import TracebackType
@@ -27,8 +29,11 @@ if TYPE_CHECKING:
 class AuthPIAdmin:
     """Entry-point client for the AuthPI Core API.
 
-    Usage with API key:
-        async with AuthPIAdmin(api_key="key_xxx") as admin:
+    Usage with API key (id + secret pair, sent as HTTP Basic):
+        async with AuthPIAdmin(
+            api_key=("key_xxx", "your_key_secret"),
+            account_id="acc_xxx",
+        ) as admin:
             users = await admin.issuer("iss_xxx").users.list()
 
     Usage with bearer token:
@@ -42,11 +47,11 @@ class AuthPIAdmin:
     def __init__(
         self,
         *,
-        api_key: str | None = None,
+        api_key: tuple[str, str] | None = None,
         access_token: str | None = None,
         on_token_expired: Callable[[], Awaitable[dict[str, str]]] | None = None,
         account_id: str | None = None,
-        base_url: str = "https://api.authpi.dev",
+        base_url: str = "https://api.authpi.com",
         http_client: httpx.AsyncClient | None = None,
         timeout: float = 30.0,
         default_headers: dict[str, str] | None = None,
@@ -56,10 +61,7 @@ class AuthPIAdmin:
             raise ConfigurationError("Either api_key or access_token is required")
         if api_key and access_token:
             raise ConfigurationError("Provide either api_key or access_token, not both")
-        if access_token and not account_id:
-            raise ConfigurationError("account_id is required when using access_token")
 
-        resolved_account_id = account_id or "me"
         self._http = HttpClient(
             base_url=base_url,
             api_key=api_key,
@@ -70,13 +72,23 @@ class AuthPIAdmin:
             default_headers=default_headers,
             retries=retries,
         )
-        self._base_path = f"/v1/accounts/{resolved_account_id}"
+        # Without an explicit account_id, paths carry a placeholder that the
+        # HttpClient substitutes at request time after resolving GET /v1/me once.
+        self._base_path = f"/v1/accounts/{account_id or UNRESOLVED_ACCOUNT_ID}"
 
     @property
     def http(self) -> HttpClient:
         """The underlying HTTP client (for advanced use)."""
         return self._http
 
+    async def whoami(self) -> dict[str, Any]:
+        """Who does the Core API consider this credential to be?
+
+        Returns the credential type and the verified accounts it can act on
+        (``GET /v1/me``).
+        """
+        return await self._http.whoami()
+
     # --- Account-level resource accessors ---
 
     @cached_property
@@ -85,9 +97,14 @@ class AuthPIAdmin:
         return AccountsResource(self._http, "/v1/accounts")
 
     @cached_property
-    def api_keys(self) -> ApiKeysResource:
+    def api_keys(self) -> AccountApiKeysResource:
         """Manage account-level API keys."""
-        return ApiKeysResource(self._http, f"{self._base_path}/api-keys")
+        return AccountApiKeysResource(self._http, f"{self._base_path}/api-keys")
+
+    @cached_property
+    def credits(self) -> CreditsResource:
+        """Account credit balance, ledger, and top-ups."""
+        return CreditsResource(self._http, f"{self._base_path}/credits")
 
     @cached_property
     def domains(self) -> DomainsResource:
@@ -110,9 +127,9 @@ class AuthPIAdmin:
         return NotesResource(self._http, f"{self._base_path}/notes")
 
     @cached_property
-    def tokens(self) -> TokensResource:
+    def tokens(self) -> AccountTokensResource:
         """Manage account-level tokens."""
-        return TokensResource(self._http, f"{self._base_path}/tokens")
+        return AccountTokensResource(self._http, f"{self._base_path}/tokens")
 
     @cached_property
     def webhooks(self) -> WebhooksResource:

authpi_admin-0.8.0/authpi_admin/generated/__init__.py

@@ -0,0 +1,38 @@
+"""Generated exports — DO NOT EDIT."""
+# ruff: noqa: F401,F403
+
+from .models import *
+from .resources.account_api_keys import AccountApiKeysResource
+from .resources.account_tokens import AccountTokensResource
+from .resources.accounts import AccountsResource
+from .resources.agent_verifiers import AgentVerifiersResource
+from .resources.agents import AgentsResource
+from .resources.approvals import ApprovalsResource
+from .resources.auth_methods import AuthMethodsResource
+from .resources.clients import ClientsResource
+from .resources.credits import CreditsResource
+from .resources.deliveries import DeliveriesResource
+from .resources.domains import DomainsResource
+from .resources.events import EventsResource
+from .resources.groups import GroupsResource
+from .resources.invitations import InvitationsResource
+from .resources.issuer_sessions import IssuerSessionsResource
+from .resources.issuer_tokens import IssuerTokensResource
+from .resources.issuers import IssuersResource
+from .resources.members import MembersResource
+from .resources.notes import NotesResource
+from .resources.organization_api_keys import OrganizationApiKeysResource
+from .resources.organizations import OrganizationsResource
+from .resources.payment_methods import PaymentMethodsResource
+from .resources.sso import SsoResource
+from .resources.trusted_devices import TrustedDevicesResource
+from .resources.user_sessions import UserSessionsResource
+from .resources.user_tokens import UserTokensResource
+from .resources.user_verifiers import UserVerifiersResource
+from .resources.users import UsersResource
+from .resources.webhooks import WebhooksResource
+from .scopes.agent_scope import AgentScope
+from .scopes.issuer_scope import IssuerScope
+from .scopes.organization_scope import OrganizationScope
+from .scopes.user_scope import UserScope
+from .scopes.webhook_scope import WebhookScope