ibm-platform-services 0.68.3__py3-none-any.whl → 0.70.0__py3-none-any.whl

ibm_platform_services/iam_identity_v1.py

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# IBM OpenAPI SDK Code Generator Version: 3.106.0-09823488-20250707-071701
+# IBM OpenAPI SDK Code Generator Version: 3.107.1-41b0fbd0-20250825-080732
 
 """
 The IAM Identity Service API allows for the management of Account Settings and Identities
@@ -2792,6 +2792,7 @@ class IamIdentityV1(BaseService):
         account_id: str,
         *,
         include_history: Optional[bool] = None,
+        resolve_user_mfa: Optional[bool] = None,
         **kwargs,
     ) -> DetailedResponse:
         """
@@ -2802,6 +2803,8 @@ class IamIdentityV1(BaseService):
         :param str account_id: Unique ID of the account.
         :param bool include_history: (optional) Defines if the entity history is
                included in the response.
+        :param bool resolve_user_mfa: (optional) Enrich MFA exemptions with user
+               PI.
         :param dict headers: A `dict` containing the request headers
         :return: A `DetailedResponse` containing the result, headers and HTTP status code.
         :rtype: DetailedResponse with `dict` result representing a `AccountSettingsResponse` object
@@ -2819,6 +2822,7 @@ class IamIdentityV1(BaseService):
 
         params = {
             'include_history': include_history,
+            'resolve_user_mfa': resolve_user_mfa,
         }
 
         if 'headers' in kwargs:
@@ -2847,14 +2851,16 @@ class IamIdentityV1(BaseService):
         *,
         restrict_create_service_id: Optional[str] = None,
         restrict_create_platform_apikey: Optional[str] = None,
+        restrict_user_list_visibility: Optional[str] = None,
+        restrict_user_domains: Optional[List['AccountSettingsUserDomainRestriction']] = None,
         allowed_ip_addresses: Optional[str] = None,
         mfa: Optional[str] = None,
-        user_mfa: Optional[List['AccountSettingsUserMFA']] = None,
         session_expiration_in_seconds: Optional[str] = None,
         session_invalidation_in_seconds: Optional[str] = None,
         max_sessions_per_identity: Optional[str] = None,
         system_access_token_expiration_in_seconds: Optional[str] = None,
         system_refresh_token_expiration_in_seconds: Optional[str] = None,
+        user_mfa: Optional[List['UserMfa']] = None,
         **kwargs,
     ) -> DetailedResponse:
         """
@@ -2871,21 +2877,31 @@ class IamIdentityV1(BaseService):
                updates.
         :param str account_id: The id of the account to update the settings for.
         :param str restrict_create_service_id: (optional) Defines whether or not
-               creating a service ID is access controlled. Valid values:
+               creating the resource is access controlled. Valid values:
                  * RESTRICTED - only users assigned the 'Service ID creator' role on the
                IAM Identity Service can create service IDs, including the account owner
                  * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str restrict_create_platform_apikey: (optional) Defines whether or
-               not creating platform API keys is access controlled. Valid values:
-                 * RESTRICTED - only users assigned the 'User API key creator' role on the
-               IAM Identity Service can create API keys, including the account owner
-                 * NOT_RESTRICTED - all members of an account can create platform API keys
+               not creating the resource is access controlled. Valid values:
+                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
+               IAM Identity Service can create service IDs, including the account owner
+                 * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
+        :param str restrict_user_list_visibility: (optional) Defines whether or not
+               user visibility is access controlled. Valid values:
+                 * RESTRICTED - users can view only specific types of users in the
+               account, such as those the user has invited to the account, or descendants
+               of those users based on the classic infrastructure hierarchy
+                 * NOT_RESTRICTED - any user in the account can view other users from the
+               Users page in IBM Cloud console.
+        :param List[AccountSettingsUserDomainRestriction] restrict_user_domains:
+               (optional) Defines if account invitations are restricted to specified
+               domains. To remove an entry for a realm_id, perform an update (PUT) request
+               with only the realm_id set.
         :param str allowed_ip_addresses: (optional) Defines the IP addresses and
                subnets from which IAM tokens can be created for the account.
-        :param str mfa: (optional) Defines the MFA trait for the account. Valid
-               values:
+        :param str mfa: (optional) MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -2893,8 +2909,6 @@ class IamIdentityV1(BaseService):
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param List[AccountSettingsUserMFA] user_mfa: (optional) List of users that
-               are exempted from the MFA requirement of the account.
         :param str session_expiration_in_seconds: (optional) Defines the session
                expiration in seconds for the account. Valid values:
                  * Any whole number between between '900' and '86400'
@@ -2905,7 +2919,7 @@ class IamIdentityV1(BaseService):
                  * Any whole number between '900' and '7200'
                  * NOT_SET - To unset account setting and use service default.
         :param str max_sessions_per_identity: (optional) Defines the max allowed
-               sessions per identity required by the account. Value values:
+               sessions per identity required by the account. Valid values:
                  * Any whole number greater than 0
                  * NOT_SET - To unset account setting and use service default.
         :param str system_access_token_expiration_in_seconds: (optional) Defines
@@ -2916,6 +2930,8 @@ class IamIdentityV1(BaseService):
                the refresh token expiration in seconds. Valid values:
                  * Any whole number between '900' and '259200'
                  * NOT_SET - To unset account setting and use service default.
+        :param List[UserMfa] user_mfa: (optional) List of users that are exempted
+               from the MFA requirement of the account.
         :param dict headers: A `dict` containing the request headers
         :return: A `DetailedResponse` containing the result, headers and HTTP status code.
         :rtype: DetailedResponse with `dict` result representing a `AccountSettingsResponse` object
@@ -2925,6 +2941,8 @@ class IamIdentityV1(BaseService):
             raise ValueError('if_match must be provided')
         if not account_id:
             raise ValueError('account_id must be provided')
+        if restrict_user_domains is not None:
+            restrict_user_domains = [convert_model(x) for x in restrict_user_domains]
         if user_mfa is not None:
             user_mfa = [convert_model(x) for x in user_mfa]
         headers = {
@@ -2940,14 +2958,16 @@ class IamIdentityV1(BaseService):
         data = {
             'restrict_create_service_id': restrict_create_service_id,
             'restrict_create_platform_apikey': restrict_create_platform_apikey,
+            'restrict_user_list_visibility': restrict_user_list_visibility,
+            'restrict_user_domains': restrict_user_domains,
             'allowed_ip_addresses': allowed_ip_addresses,
             'mfa': mfa,
-            'user_mfa': user_mfa,
             'session_expiration_in_seconds': session_expiration_in_seconds,
             'session_invalidation_in_seconds': session_invalidation_in_seconds,
             'max_sessions_per_identity': max_sessions_per_identity,
             'system_access_token_expiration_in_seconds': system_access_token_expiration_in_seconds,
             'system_refresh_token_expiration_in_seconds': system_refresh_token_expiration_in_seconds,
+            'user_mfa': user_mfa,
         }
         data = {k: v for (k, v) in data.items() if v is not None}
         data = json.dumps(data)
@@ -5727,314 +5747,39 @@ class AccountBasedMfaEnrollment:
         return not self == other
 
 
-class AccountSettingsAccountSection:
+class AccountSettingsAssignedTemplatesSection:
     """
-    AccountSettingsAccountSection.
+    Response body format for Account Settings REST requests.
 
-    :param str account_id: (optional) Unique ID of the account.
+    :param str template_id: Template Id.
+    :param int template_version: Template version.
+    :param str template_name: Template name.
     :param str restrict_create_service_id: (optional) Defines whether or not
-          creating a service ID is access controlled. Valid values:
+          creating the resource is access controlled. Valid values:
             * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
           Identity Service can create service IDs, including the account owner
             * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
     :param str restrict_create_platform_apikey: (optional) Defines whether or not
-          creating platform API keys is access controlled. Valid values:
-            * RESTRICTED - to apply access control
-            * NOT_RESTRICTED - to remove access control
-            * NOT_SET - to 'unset' a previous set value.
-    :param str allowed_ip_addresses: (optional) Defines the IP addresses and subnets
-          from which IAM tokens can be created for the account.
-    :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-          values:
-            * NONE - No MFA trait set
-            * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-            * TOTP - For all non-federated IBMId users
-            * TOTP4ALL - For all users
-            * LEVEL1 - Email-based MFA for all users
-            * LEVEL2 - TOTP-based MFA for all users
-            * LEVEL3 - U2F MFA for all users.
-    :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of users
-          that are exempted from the MFA requirement of the account.
-    :param List[EnityHistoryRecord] history: (optional) History of the Account
-          Settings.
-    :param str session_expiration_in_seconds: (optional) Defines the session
-          expiration in seconds for the account. Valid values:
-            * Any whole number between between '900' and '86400'
-            * NOT_SET - To unset account setting and use service default.
-    :param str session_invalidation_in_seconds: (optional) Defines the period of
-          time in seconds in which a session will be invalidated due to inactivity. Valid
-          values:
-            * Any whole number between '900' and '7200'
-            * NOT_SET - To unset account setting and use service default.
-    :param str max_sessions_per_identity: (optional) Defines the max allowed
-          sessions per identity required by the account. Valid values:
-            * Any whole number greater than 0
-            * NOT_SET - To unset account setting and use service default.
-    :param str system_access_token_expiration_in_seconds: (optional) Defines the
-          access token expiration in seconds. Valid values:
-            * Any whole number between '900' and '3600'
-            * NOT_SET - To unset account setting and use service default.
-    :param str system_refresh_token_expiration_in_seconds: (optional) Defines the
-          refresh token expiration in seconds. Valid values:
-            * Any whole number between '900' and '259200'
-            * NOT_SET - To unset account setting and use service default.
-    """
-
-    def __init__(
-        self,
-        *,
-        account_id: Optional[str] = None,
-        restrict_create_service_id: Optional[str] = None,
-        restrict_create_platform_apikey: Optional[str] = None,
-        allowed_ip_addresses: Optional[str] = None,
-        mfa: Optional[str] = None,
-        user_mfa: Optional[List['EffectiveAccountSettingsUserMFA']] = None,
-        history: Optional[List['EnityHistoryRecord']] = None,
-        session_expiration_in_seconds: Optional[str] = None,
-        session_invalidation_in_seconds: Optional[str] = None,
-        max_sessions_per_identity: Optional[str] = None,
-        system_access_token_expiration_in_seconds: Optional[str] = None,
-        system_refresh_token_expiration_in_seconds: Optional[str] = None,
-    ) -> None:
-        """
-        Initialize a AccountSettingsAccountSection object.
-
-        :param str account_id: (optional) Unique ID of the account.
-        :param str restrict_create_service_id: (optional) Defines whether or not
-               creating a service ID is access controlled. Valid values:
-                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
-               IAM Identity Service can create service IDs, including the account owner
-                 * NOT_RESTRICTED - all members of an account can create service IDs
-                 * NOT_SET - to 'unset' a previous set value.
-        :param str restrict_create_platform_apikey: (optional) Defines whether or
-               not creating platform API keys is access controlled. Valid values:
-                 * RESTRICTED - to apply access control
-                 * NOT_RESTRICTED - to remove access control
-                 * NOT_SET - to 'unset' a previous set value.
-        :param str allowed_ip_addresses: (optional) Defines the IP addresses and
-               subnets from which IAM tokens can be created for the account.
-        :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-               values:
-                 * NONE - No MFA trait set
-                 * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-                 * TOTP - For all non-federated IBMId users
-                 * TOTP4ALL - For all users
-                 * LEVEL1 - Email-based MFA for all users
-                 * LEVEL2 - TOTP-based MFA for all users
-                 * LEVEL3 - U2F MFA for all users.
-        :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of
-               users that are exempted from the MFA requirement of the account.
-        :param List[EnityHistoryRecord] history: (optional) History of the Account
-               Settings.
-        :param str session_expiration_in_seconds: (optional) Defines the session
-               expiration in seconds for the account. Valid values:
-                 * Any whole number between between '900' and '86400'
-                 * NOT_SET - To unset account setting and use service default.
-        :param str session_invalidation_in_seconds: (optional) Defines the period
-               of time in seconds in which a session will be invalidated due to
-               inactivity. Valid values:
-                 * Any whole number between '900' and '7200'
-                 * NOT_SET - To unset account setting and use service default.
-        :param str max_sessions_per_identity: (optional) Defines the max allowed
-               sessions per identity required by the account. Valid values:
-                 * Any whole number greater than 0
-                 * NOT_SET - To unset account setting and use service default.
-        :param str system_access_token_expiration_in_seconds: (optional) Defines
-               the access token expiration in seconds. Valid values:
-                 * Any whole number between '900' and '3600'
-                 * NOT_SET - To unset account setting and use service default.
-        :param str system_refresh_token_expiration_in_seconds: (optional) Defines
-               the refresh token expiration in seconds. Valid values:
-                 * Any whole number between '900' and '259200'
-                 * NOT_SET - To unset account setting and use service default.
-        """
-        self.account_id = account_id
-        self.restrict_create_service_id = restrict_create_service_id
-        self.restrict_create_platform_apikey = restrict_create_platform_apikey
-        self.allowed_ip_addresses = allowed_ip_addresses
-        self.mfa = mfa
-        self.user_mfa = user_mfa
-        self.history = history
-        self.session_expiration_in_seconds = session_expiration_in_seconds
-        self.session_invalidation_in_seconds = session_invalidation_in_seconds
-        self.max_sessions_per_identity = max_sessions_per_identity
-        self.system_access_token_expiration_in_seconds = system_access_token_expiration_in_seconds
-        self.system_refresh_token_expiration_in_seconds = system_refresh_token_expiration_in_seconds
-
-    @classmethod
-    def from_dict(cls, _dict: Dict) -> 'AccountSettingsAccountSection':
-        """Initialize a AccountSettingsAccountSection object from a json dictionary."""
-        args = {}
-        if (account_id := _dict.get('account_id')) is not None:
-            args['account_id'] = account_id
-        if (restrict_create_service_id := _dict.get('restrict_create_service_id')) is not None:
-            args['restrict_create_service_id'] = restrict_create_service_id
-        if (restrict_create_platform_apikey := _dict.get('restrict_create_platform_apikey')) is not None:
-            args['restrict_create_platform_apikey'] = restrict_create_platform_apikey
-        if (allowed_ip_addresses := _dict.get('allowed_ip_addresses')) is not None:
-            args['allowed_ip_addresses'] = allowed_ip_addresses
-        if (mfa := _dict.get('mfa')) is not None:
-            args['mfa'] = mfa
-        if (user_mfa := _dict.get('user_mfa')) is not None:
-            args['user_mfa'] = [EffectiveAccountSettingsUserMFA.from_dict(v) for v in user_mfa]
-        if (history := _dict.get('history')) is not None:
-            args['history'] = [EnityHistoryRecord.from_dict(v) for v in history]
-        if (session_expiration_in_seconds := _dict.get('session_expiration_in_seconds')) is not None:
-            args['session_expiration_in_seconds'] = session_expiration_in_seconds
-        if (session_invalidation_in_seconds := _dict.get('session_invalidation_in_seconds')) is not None:
-            args['session_invalidation_in_seconds'] = session_invalidation_in_seconds
-        if (max_sessions_per_identity := _dict.get('max_sessions_per_identity')) is not None:
-            args['max_sessions_per_identity'] = max_sessions_per_identity
-        if (
-            system_access_token_expiration_in_seconds := _dict.get('system_access_token_expiration_in_seconds')
-        ) is not None:
-            args['system_access_token_expiration_in_seconds'] = system_access_token_expiration_in_seconds
-        if (
-            system_refresh_token_expiration_in_seconds := _dict.get('system_refresh_token_expiration_in_seconds')
-        ) is not None:
-            args['system_refresh_token_expiration_in_seconds'] = system_refresh_token_expiration_in_seconds
-        return cls(**args)
-
-    @classmethod
-    def _from_dict(cls, _dict):
-        """Initialize a AccountSettingsAccountSection object from a json dictionary."""
-        return cls.from_dict(_dict)
-
-    def to_dict(self) -> Dict:
-        """Return a json dictionary representing this model."""
-        _dict = {}
-        if hasattr(self, 'account_id') and self.account_id is not None:
-            _dict['account_id'] = self.account_id
-        if hasattr(self, 'restrict_create_service_id') and self.restrict_create_service_id is not None:
-            _dict['restrict_create_service_id'] = self.restrict_create_service_id
-        if hasattr(self, 'restrict_create_platform_apikey') and self.restrict_create_platform_apikey is not None:
-            _dict['restrict_create_platform_apikey'] = self.restrict_create_platform_apikey
-        if hasattr(self, 'allowed_ip_addresses') and self.allowed_ip_addresses is not None:
-            _dict['allowed_ip_addresses'] = self.allowed_ip_addresses
-        if hasattr(self, 'mfa') and self.mfa is not None:
-            _dict['mfa'] = self.mfa
-        if hasattr(self, 'user_mfa') and self.user_mfa is not None:
-            user_mfa_list = []
-            for v in self.user_mfa:
-                if isinstance(v, dict):
-                    user_mfa_list.append(v)
-                else:
-                    user_mfa_list.append(v.to_dict())
-            _dict['user_mfa'] = user_mfa_list
-        if hasattr(self, 'history') and self.history is not None:
-            history_list = []
-            for v in self.history:
-                if isinstance(v, dict):
-                    history_list.append(v)
-                else:
-                    history_list.append(v.to_dict())
-            _dict['history'] = history_list
-        if hasattr(self, 'session_expiration_in_seconds') and self.session_expiration_in_seconds is not None:
-            _dict['session_expiration_in_seconds'] = self.session_expiration_in_seconds
-        if hasattr(self, 'session_invalidation_in_seconds') and self.session_invalidation_in_seconds is not None:
-            _dict['session_invalidation_in_seconds'] = self.session_invalidation_in_seconds
-        if hasattr(self, 'max_sessions_per_identity') and self.max_sessions_per_identity is not None:
-            _dict['max_sessions_per_identity'] = self.max_sessions_per_identity
-        if (
-            hasattr(self, 'system_access_token_expiration_in_seconds')
-            and self.system_access_token_expiration_in_seconds is not None
-        ):
-            _dict['system_access_token_expiration_in_seconds'] = self.system_access_token_expiration_in_seconds
-        if (
-            hasattr(self, 'system_refresh_token_expiration_in_seconds')
-            and self.system_refresh_token_expiration_in_seconds is not None
-        ):
-            _dict['system_refresh_token_expiration_in_seconds'] = self.system_refresh_token_expiration_in_seconds
-        return _dict
-
-    def _to_dict(self):
-        """Return a json dictionary representing this model."""
-        return self.to_dict()
-
-    def __str__(self) -> str:
-        """Return a `str` version of this AccountSettingsAccountSection object."""
-        return json.dumps(self.to_dict(), indent=2)
-
-    def __eq__(self, other: 'AccountSettingsAccountSection') -> bool:
-        """Return `true` when self and other are equal, false otherwise."""
-        if not isinstance(other, self.__class__):
-            return False
-        return self.__dict__ == other.__dict__
-
-    def __ne__(self, other: 'AccountSettingsAccountSection') -> bool:
-        """Return `true` when self and other are not equal, false otherwise."""
-        return not self == other
-
-    class RestrictCreateServiceIdEnum(str, Enum):
-        """
-        Defines whether or not creating a service ID is access controlled. Valid values:
-          * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
-        Identity Service can create service IDs, including the account owner
-          * NOT_RESTRICTED - all members of an account can create service IDs
-          * NOT_SET - to 'unset' a previous set value.
-        """
-
-        RESTRICTED = 'RESTRICTED'
-        NOT_RESTRICTED = 'NOT_RESTRICTED'
-        NOT_SET = 'NOT_SET'
-
-    class RestrictCreatePlatformApikeyEnum(str, Enum):
-        """
-        Defines whether or not creating platform API keys is access controlled. Valid
-        values:
-          * RESTRICTED - to apply access control
-          * NOT_RESTRICTED - to remove access control
-          * NOT_SET - to 'unset' a previous set value.
-        """
-
-        RESTRICTED = 'RESTRICTED'
-        NOT_RESTRICTED = 'NOT_RESTRICTED'
-        NOT_SET = 'NOT_SET'
-
-    class MfaEnum(str, Enum):
-        """
-        Defines the MFA requirement for the user. Valid values:
-          * NONE - No MFA trait set
-          * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-          * TOTP - For all non-federated IBMId users
-          * TOTP4ALL - For all users
-          * LEVEL1 - Email-based MFA for all users
-          * LEVEL2 - TOTP-based MFA for all users
-          * LEVEL3 - U2F MFA for all users.
-        """
-
-        NONE = 'NONE'
-        NONE_NO_ROPC = 'NONE_NO_ROPC'
-        TOTP = 'TOTP'
-        TOTP4ALL = 'TOTP4ALL'
-        LEVEL1 = 'LEVEL1'
-        LEVEL2 = 'LEVEL2'
-        LEVEL3 = 'LEVEL3'
-
-
-class AccountSettingsAssignedTemplatesSection:
-    """
-    AccountSettingsAssignedTemplatesSection.
-
-    :param str template_id: (optional) Template Id.
-    :param int template_version: (optional) Template version.
-    :param str template_name: (optional) Template name.
-    :param str restrict_create_service_id: (optional) Defines whether or not
-          creating a service ID is access controlled. Valid values:
+          creating the resource is access controlled. Valid values:
             * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
           Identity Service can create service IDs, including the account owner
             * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
-    :param str restrict_create_platform_apikey: (optional) Defines whether or not
-          creating platform API keys is access controlled. Valid values:
-            * RESTRICTED - to apply access control
-            * NOT_RESTRICTED - to remove access control
-            * NOT_SET - to 'unset' a previous set value.
+    :param str restrict_user_list_visibility: (optional) Defines whether or not user
+          visibility is access controlled. Valid values:
+            * RESTRICTED - users can view only specific types of users in the account,
+          such as those the user has invited to the account, or descendants of those users
+          based on the classic infrastructure hierarchy
+            * NOT_RESTRICTED - any user in the account can view other users from the Users
+          page in IBM Cloud console.
+    :param List[AccountSettingsUserDomainRestriction] restrict_user_domains:
+          (optional) Defines if account invitations are restricted to specified domains.
+          To remove an entry for a realm_id, perform an update (PUT) request with only the
+          realm_id set.
     :param str allowed_ip_addresses: (optional) Defines the IP addresses and subnets
           from which IAM tokens can be created for the account.
-    :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-          values:
+    :param str mfa: (optional) MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -6042,8 +5787,6 @@ class AccountSettingsAssignedTemplatesSection:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of users
-          that are exempted from the MFA requirement of the account.
     :param str session_expiration_in_seconds: (optional) Defines the session
           expiration in seconds for the account. Valid values:
             * Any whole number between between '900' and '86400'
@@ -6065,46 +5808,61 @@ class AccountSettingsAssignedTemplatesSection:
           refresh token expiration in seconds. Valid values:
             * Any whole number between '900' and '259200'
             * NOT_SET - To unset account setting and use service default.
+    :param List[AccountSettingsUserMFAResponse] user_mfa: (optional) List of users
+          that are exempted from the MFA requirement of the account.
     """
 
     def __init__(
         self,
+        template_id: str,
+        template_version: int,
+        template_name: str,
         *,
-        template_id: Optional[str] = None,
-        template_version: Optional[int] = None,
-        template_name: Optional[str] = None,
         restrict_create_service_id: Optional[str] = None,
         restrict_create_platform_apikey: Optional[str] = None,
+        restrict_user_list_visibility: Optional[str] = None,
+        restrict_user_domains: Optional[List['AccountSettingsUserDomainRestriction']] = None,
         allowed_ip_addresses: Optional[str] = None,
         mfa: Optional[str] = None,
-        user_mfa: Optional[List['EffectiveAccountSettingsUserMFA']] = None,
         session_expiration_in_seconds: Optional[str] = None,
         session_invalidation_in_seconds: Optional[str] = None,
         max_sessions_per_identity: Optional[str] = None,
         system_access_token_expiration_in_seconds: Optional[str] = None,
         system_refresh_token_expiration_in_seconds: Optional[str] = None,
+        user_mfa: Optional[List['AccountSettingsUserMFAResponse']] = None,
     ) -> None:
         """
         Initialize a AccountSettingsAssignedTemplatesSection object.
 
-        :param str template_id: (optional) Template Id.
-        :param int template_version: (optional) Template version.
-        :param str template_name: (optional) Template name.
+        :param str template_id: Template Id.
+        :param int template_version: Template version.
+        :param str template_name: Template name.
         :param str restrict_create_service_id: (optional) Defines whether or not
-               creating a service ID is access controlled. Valid values:
+               creating the resource is access controlled. Valid values:
                  * RESTRICTED - only users assigned the 'Service ID creator' role on the
                IAM Identity Service can create service IDs, including the account owner
                  * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str restrict_create_platform_apikey: (optional) Defines whether or
-               not creating platform API keys is access controlled. Valid values:
-                 * RESTRICTED - to apply access control
-                 * NOT_RESTRICTED - to remove access control
+               not creating the resource is access controlled. Valid values:
+                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
+               IAM Identity Service can create service IDs, including the account owner
+                 * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
+        :param str restrict_user_list_visibility: (optional) Defines whether or not
+               user visibility is access controlled. Valid values:
+                 * RESTRICTED - users can view only specific types of users in the
+               account, such as those the user has invited to the account, or descendants
+               of those users based on the classic infrastructure hierarchy
+                 * NOT_RESTRICTED - any user in the account can view other users from the
+               Users page in IBM Cloud console.
+        :param List[AccountSettingsUserDomainRestriction] restrict_user_domains:
+               (optional) Defines if account invitations are restricted to specified
+               domains. To remove an entry for a realm_id, perform an update (PUT) request
+               with only the realm_id set.
         :param str allowed_ip_addresses: (optional) Defines the IP addresses and
                subnets from which IAM tokens can be created for the account.
-        :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-               values:
+        :param str mfa: (optional) MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -6112,8 +5870,6 @@ class AccountSettingsAssignedTemplatesSection:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of
-               users that are exempted from the MFA requirement of the account.
         :param str session_expiration_in_seconds: (optional) Defines the session
                expiration in seconds for the account. Valid values:
                  * Any whole number between between '900' and '86400'
@@ -6135,20 +5891,24 @@ class AccountSettingsAssignedTemplatesSection:
                the refresh token expiration in seconds. Valid values:
                  * Any whole number between '900' and '259200'
                  * NOT_SET - To unset account setting and use service default.
+        :param List[AccountSettingsUserMFAResponse] user_mfa: (optional) List of
+               users that are exempted from the MFA requirement of the account.
         """
         self.template_id = template_id
         self.template_version = template_version
         self.template_name = template_name
         self.restrict_create_service_id = restrict_create_service_id
         self.restrict_create_platform_apikey = restrict_create_platform_apikey
+        self.restrict_user_list_visibility = restrict_user_list_visibility
+        self.restrict_user_domains = restrict_user_domains
         self.allowed_ip_addresses = allowed_ip_addresses
         self.mfa = mfa
-        self.user_mfa = user_mfa
         self.session_expiration_in_seconds = session_expiration_in_seconds
         self.session_invalidation_in_seconds = session_invalidation_in_seconds
         self.max_sessions_per_identity = max_sessions_per_identity
         self.system_access_token_expiration_in_seconds = system_access_token_expiration_in_seconds
         self.system_refresh_token_expiration_in_seconds = system_refresh_token_expiration_in_seconds
+        self.user_mfa = user_mfa
 
     @classmethod
     def from_dict(cls, _dict: Dict) -> 'AccountSettingsAssignedTemplatesSection':
@@ -6156,20 +5916,36 @@ class AccountSettingsAssignedTemplatesSection:
         args = {}
         if (template_id := _dict.get('template_id')) is not None:
             args['template_id'] = template_id
+        else:
+            raise ValueError(
+                'Required property \'template_id\' not present in AccountSettingsAssignedTemplatesSection JSON'
+            )
         if (template_version := _dict.get('template_version')) is not None:
             args['template_version'] = template_version
+        else:
+            raise ValueError(
+                'Required property \'template_version\' not present in AccountSettingsAssignedTemplatesSection JSON'
+            )
         if (template_name := _dict.get('template_name')) is not None:
             args['template_name'] = template_name
+        else:
+            raise ValueError(
+                'Required property \'template_name\' not present in AccountSettingsAssignedTemplatesSection JSON'
+            )
         if (restrict_create_service_id := _dict.get('restrict_create_service_id')) is not None:
             args['restrict_create_service_id'] = restrict_create_service_id
         if (restrict_create_platform_apikey := _dict.get('restrict_create_platform_apikey')) is not None:
             args['restrict_create_platform_apikey'] = restrict_create_platform_apikey
+        if (restrict_user_list_visibility := _dict.get('restrict_user_list_visibility')) is not None:
+            args['restrict_user_list_visibility'] = restrict_user_list_visibility
+        if (restrict_user_domains := _dict.get('restrict_user_domains')) is not None:
+            args['restrict_user_domains'] = [
+                AccountSettingsUserDomainRestriction.from_dict(v) for v in restrict_user_domains
+            ]
         if (allowed_ip_addresses := _dict.get('allowed_ip_addresses')) is not None:
             args['allowed_ip_addresses'] = allowed_ip_addresses
         if (mfa := _dict.get('mfa')) is not None:
             args['mfa'] = mfa
-        if (user_mfa := _dict.get('user_mfa')) is not None:
-            args['user_mfa'] = [EffectiveAccountSettingsUserMFA.from_dict(v) for v in user_mfa]
         if (session_expiration_in_seconds := _dict.get('session_expiration_in_seconds')) is not None:
             args['session_expiration_in_seconds'] = session_expiration_in_seconds
         if (session_invalidation_in_seconds := _dict.get('session_invalidation_in_seconds')) is not None:
@@ -6184,6 +5960,8 @@ class AccountSettingsAssignedTemplatesSection:
             system_refresh_token_expiration_in_seconds := _dict.get('system_refresh_token_expiration_in_seconds')
         ) is not None:
             args['system_refresh_token_expiration_in_seconds'] = system_refresh_token_expiration_in_seconds
+        if (user_mfa := _dict.get('user_mfa')) is not None:
+            args['user_mfa'] = [AccountSettingsUserMFAResponse.from_dict(v) for v in user_mfa]
         return cls(**args)
 
     @classmethod
@@ -6204,18 +5982,20 @@ class AccountSettingsAssignedTemplatesSection:
             _dict['restrict_create_service_id'] = self.restrict_create_service_id
         if hasattr(self, 'restrict_create_platform_apikey') and self.restrict_create_platform_apikey is not None:
             _dict['restrict_create_platform_apikey'] = self.restrict_create_platform_apikey
+        if hasattr(self, 'restrict_user_list_visibility') and self.restrict_user_list_visibility is not None:
+            _dict['restrict_user_list_visibility'] = self.restrict_user_list_visibility
+        if hasattr(self, 'restrict_user_domains') and self.restrict_user_domains is not None:
+            restrict_user_domains_list = []
+            for v in self.restrict_user_domains:
+                if isinstance(v, dict):
+                    restrict_user_domains_list.append(v)
+                else:
+                    restrict_user_domains_list.append(v.to_dict())
+            _dict['restrict_user_domains'] = restrict_user_domains_list
         if hasattr(self, 'allowed_ip_addresses') and self.allowed_ip_addresses is not None:
             _dict['allowed_ip_addresses'] = self.allowed_ip_addresses
         if hasattr(self, 'mfa') and self.mfa is not None:
             _dict['mfa'] = self.mfa
-        if hasattr(self, 'user_mfa') and self.user_mfa is not None:
-            user_mfa_list = []
-            for v in self.user_mfa:
-                if isinstance(v, dict):
-                    user_mfa_list.append(v)
-                else:
-                    user_mfa_list.append(v.to_dict())
-            _dict['user_mfa'] = user_mfa_list
         if hasattr(self, 'session_expiration_in_seconds') and self.session_expiration_in_seconds is not None:
             _dict['session_expiration_in_seconds'] = self.session_expiration_in_seconds
         if hasattr(self, 'session_invalidation_in_seconds') and self.session_invalidation_in_seconds is not None:
@@ -6232,6 +6012,14 @@ class AccountSettingsAssignedTemplatesSection:
             and self.system_refresh_token_expiration_in_seconds is not None
         ):
             _dict['system_refresh_token_expiration_in_seconds'] = self.system_refresh_token_expiration_in_seconds
+        if hasattr(self, 'user_mfa') and self.user_mfa is not None:
+            user_mfa_list = []
+            for v in self.user_mfa:
+                if isinstance(v, dict):
+                    user_mfa_list.append(v)
+                else:
+                    user_mfa_list.append(v.to_dict())
+            _dict['user_mfa'] = user_mfa_list
         return _dict
 
     def _to_dict(self):
@@ -6254,7 +6042,7 @@ class AccountSettingsAssignedTemplatesSection:
 
     class RestrictCreateServiceIdEnum(str, Enum):
         """
-        Defines whether or not creating a service ID is access controlled. Valid values:
+        Defines whether or not creating the resource is access controlled. Valid values:
           * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
         Identity Service can create service IDs, including the account owner
           * NOT_RESTRICTED - all members of an account can create service IDs
@@ -6267,10 +6055,10 @@ class AccountSettingsAssignedTemplatesSection:
 
     class RestrictCreatePlatformApikeyEnum(str, Enum):
         """
-        Defines whether or not creating platform API keys is access controlled. Valid
-        values:
-          * RESTRICTED - to apply access control
-          * NOT_RESTRICTED - to remove access control
+        Defines whether or not creating the resource is access controlled. Valid values:
+          * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+        Identity Service can create service IDs, including the account owner
+          * NOT_RESTRICTED - all members of an account can create service IDs
           * NOT_SET - to 'unset' a previous set value.
         """
 
@@ -6278,9 +6066,22 @@ class AccountSettingsAssignedTemplatesSection:
         NOT_RESTRICTED = 'NOT_RESTRICTED'
         NOT_SET = 'NOT_SET'
 
+    class RestrictUserListVisibilityEnum(str, Enum):
+        """
+        Defines whether or not user visibility is access controlled. Valid values:
+          * RESTRICTED - users can view only specific types of users in the account, such
+        as those the user has invited to the account, or descendants of those users based
+        on the classic infrastructure hierarchy
+          * NOT_RESTRICTED - any user in the account can view other users from the Users
+        page in IBM Cloud console.
+        """
+
+        NOT_RESTRICTED = 'NOT_RESTRICTED'
+        RESTRICTED = 'RESTRICTED'
+
     class MfaEnum(str, Enum):
         """
-        Defines the MFA requirement for the user. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -6304,19 +6105,20 @@ class AccountSettingsComponent:
     AccountSettingsComponent.
 
     :param str restrict_create_service_id: (optional) Defines whether or not
-          creating a service ID is access controlled. Valid values:
+          creating the resource is access controlled. Valid values:
             * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
           Identity Service can create service IDs, including the account owner
             * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
     :param str restrict_create_platform_apikey: (optional) Defines whether or not
-          creating platform API keys is access controlled. Valid values:
-            * RESTRICTED - to apply access control
-            * NOT_RESTRICTED - to remove access control
+          creating the resource is access controlled. Valid values:
+            * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+          Identity Service can create service IDs, including the account owner
+            * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
     :param str allowed_ip_addresses: (optional) Defines the IP addresses and subnets
           from which IAM tokens can be created for the account.
-    :param str mfa: (optional) Defines the MFA trait for the account. Valid values:
+    :param str mfa: (optional) MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -6324,8 +6126,8 @@ class AccountSettingsComponent:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param List[AccountSettingsUserMFA] user_mfa: (optional) List of users that are
-          exempted from the MFA requirement of the account.
+    :param List[UserMfa] user_mfa: (optional) List of users that are exempted from
+          the MFA requirement of the account.
     :param str session_expiration_in_seconds: (optional) Defines the session
           expiration in seconds for the account. Valid values:
             * Any whole number between between '900' and '86400'
@@ -6356,7 +6158,7 @@ class AccountSettingsComponent:
         restrict_create_platform_apikey: Optional[str] = None,
         allowed_ip_addresses: Optional[str] = None,
         mfa: Optional[str] = None,
-        user_mfa: Optional[List['AccountSettingsUserMFA']] = None,
+        user_mfa: Optional[List['UserMfa']] = None,
         session_expiration_in_seconds: Optional[str] = None,
         session_invalidation_in_seconds: Optional[str] = None,
         max_sessions_per_identity: Optional[str] = None,
@@ -6367,20 +6169,20 @@ class AccountSettingsComponent:
         Initialize a AccountSettingsComponent object.
 
         :param str restrict_create_service_id: (optional) Defines whether or not
-               creating a service ID is access controlled. Valid values:
+               creating the resource is access controlled. Valid values:
                  * RESTRICTED - only users assigned the 'Service ID creator' role on the
                IAM Identity Service can create service IDs, including the account owner
                  * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str restrict_create_platform_apikey: (optional) Defines whether or
-               not creating platform API keys is access controlled. Valid values:
-                 * RESTRICTED - to apply access control
-                 * NOT_RESTRICTED - to remove access control
+               not creating the resource is access controlled. Valid values:
+                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
+               IAM Identity Service can create service IDs, including the account owner
+                 * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str allowed_ip_addresses: (optional) Defines the IP addresses and
                subnets from which IAM tokens can be created for the account.
-        :param str mfa: (optional) Defines the MFA trait for the account. Valid
-               values:
+        :param str mfa: (optional) MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -6388,8 +6190,8 @@ class AccountSettingsComponent:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param List[AccountSettingsUserMFA] user_mfa: (optional) List of users that
-               are exempted from the MFA requirement of the account.
+        :param List[UserMfa] user_mfa: (optional) List of users that are exempted
+               from the MFA requirement of the account.
         :param str session_expiration_in_seconds: (optional) Defines the session
                expiration in seconds for the account. Valid values:
                  * Any whole number between between '900' and '86400'
@@ -6436,7 +6238,7 @@ class AccountSettingsComponent:
         if (mfa := _dict.get('mfa')) is not None:
             args['mfa'] = mfa
         if (user_mfa := _dict.get('user_mfa')) is not None:
-            args['user_mfa'] = [AccountSettingsUserMFA.from_dict(v) for v in user_mfa]
+            args['user_mfa'] = [UserMfa.from_dict(v) for v in user_mfa]
         if (session_expiration_in_seconds := _dict.get('session_expiration_in_seconds')) is not None:
             args['session_expiration_in_seconds'] = session_expiration_in_seconds
         if (session_invalidation_in_seconds := _dict.get('session_invalidation_in_seconds')) is not None:
@@ -6515,7 +6317,7 @@ class AccountSettingsComponent:
 
     class RestrictCreateServiceIdEnum(str, Enum):
         """
-        Defines whether or not creating a service ID is access controlled. Valid values:
+        Defines whether or not creating the resource is access controlled. Valid values:
           * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
         Identity Service can create service IDs, including the account owner
           * NOT_RESTRICTED - all members of an account can create service IDs
@@ -6528,10 +6330,10 @@ class AccountSettingsComponent:
 
     class RestrictCreatePlatformApikeyEnum(str, Enum):
         """
-        Defines whether or not creating platform API keys is access controlled. Valid
-        values:
-          * RESTRICTED - to apply access control
-          * NOT_RESTRICTED - to remove access control
+        Defines whether or not creating the resource is access controlled. Valid values:
+          * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+        Identity Service can create service IDs, including the account owner
+          * NOT_RESTRICTED - all members of an account can create service IDs
           * NOT_SET - to 'unset' a previous set value.
         """
 
@@ -6541,7 +6343,7 @@ class AccountSettingsComponent:
 
     class MfaEnum(str, Enum):
         """
-        Defines the MFA trait for the account. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -6565,20 +6367,27 @@ class AccountSettingsEffectiveSection:
     AccountSettingsEffectiveSection.
 
     :param str restrict_create_service_id: (optional) Defines whether or not
-          creating a service ID is access controlled. Valid values:
+          creating the resource is access controlled. Valid values:
             * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
           Identity Service can create service IDs, including the account owner
             * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
     :param str restrict_create_platform_apikey: (optional) Defines whether or not
-          creating platform API keys is access controlled. Valid values:
-            * RESTRICTED - to apply access control
-            * NOT_RESTRICTED - to remove access control
+          creating the resource is access controlled. Valid values:
+            * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+          Identity Service can create service IDs, including the account owner
+            * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
+    :param str restrict_user_list_visibility: (optional) Defines whether or not user
+          visibility is access controlled. Valid values:
+            * RESTRICTED - users can view only specific types of users in the account,
+          such as those the user has invited to the account, or descendants of those users
+          based on the classic infrastructure hierarchy
+            * NOT_RESTRICTED - any user in the account can view other users from the Users
+          page in IBM Cloud console.
     :param str allowed_ip_addresses: (optional) Defines the IP addresses and subnets
           from which IAM tokens can be created for the account.
-    :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-          values:
+    :param str mfa: (optional) MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -6586,7 +6395,7 @@ class AccountSettingsEffectiveSection:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of users
+    :param List[AccountSettingsUserMFAResponse] user_mfa: (optional) List of users
           that are exempted from the MFA requirement of the account.
     :param str session_expiration_in_seconds: (optional) Defines the session
           expiration in seconds for the account. Valid values:
@@ -6616,9 +6425,10 @@ class AccountSettingsEffectiveSection:
         *,
         restrict_create_service_id: Optional[str] = None,
         restrict_create_platform_apikey: Optional[str] = None,
+        restrict_user_list_visibility: Optional[str] = None,
         allowed_ip_addresses: Optional[str] = None,
         mfa: Optional[str] = None,
-        user_mfa: Optional[List['EffectiveAccountSettingsUserMFA']] = None,
+        user_mfa: Optional[List['AccountSettingsUserMFAResponse']] = None,
         session_expiration_in_seconds: Optional[str] = None,
         session_invalidation_in_seconds: Optional[str] = None,
         max_sessions_per_identity: Optional[str] = None,
@@ -6629,20 +6439,27 @@ class AccountSettingsEffectiveSection:
         Initialize a AccountSettingsEffectiveSection object.
 
         :param str restrict_create_service_id: (optional) Defines whether or not
-               creating a service ID is access controlled. Valid values:
+               creating the resource is access controlled. Valid values:
                  * RESTRICTED - only users assigned the 'Service ID creator' role on the
                IAM Identity Service can create service IDs, including the account owner
                  * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str restrict_create_platform_apikey: (optional) Defines whether or
-               not creating platform API keys is access controlled. Valid values:
-                 * RESTRICTED - to apply access control
-                 * NOT_RESTRICTED - to remove access control
+               not creating the resource is access controlled. Valid values:
+                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
+               IAM Identity Service can create service IDs, including the account owner
+                 * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
+        :param str restrict_user_list_visibility: (optional) Defines whether or not
+               user visibility is access controlled. Valid values:
+                 * RESTRICTED - users can view only specific types of users in the
+               account, such as those the user has invited to the account, or descendants
+               of those users based on the classic infrastructure hierarchy
+                 * NOT_RESTRICTED - any user in the account can view other users from the
+               Users page in IBM Cloud console.
         :param str allowed_ip_addresses: (optional) Defines the IP addresses and
                subnets from which IAM tokens can be created for the account.
-        :param str mfa: (optional) Defines the MFA requirement for the user. Valid
-               values:
+        :param str mfa: (optional) MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -6650,7 +6467,7 @@ class AccountSettingsEffectiveSection:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param List[EffectiveAccountSettingsUserMFA] user_mfa: (optional) List of
+        :param List[AccountSettingsUserMFAResponse] user_mfa: (optional) List of
                users that are exempted from the MFA requirement of the account.
         :param str session_expiration_in_seconds: (optional) Defines the session
                expiration in seconds for the account. Valid values:
@@ -6676,6 +6493,7 @@ class AccountSettingsEffectiveSection:
         """
         self.restrict_create_service_id = restrict_create_service_id
         self.restrict_create_platform_apikey = restrict_create_platform_apikey
+        self.restrict_user_list_visibility = restrict_user_list_visibility
         self.allowed_ip_addresses = allowed_ip_addresses
         self.mfa = mfa
         self.user_mfa = user_mfa
@@ -6693,12 +6511,14 @@ class AccountSettingsEffectiveSection:
             args['restrict_create_service_id'] = restrict_create_service_id
         if (restrict_create_platform_apikey := _dict.get('restrict_create_platform_apikey')) is not None:
             args['restrict_create_platform_apikey'] = restrict_create_platform_apikey
+        if (restrict_user_list_visibility := _dict.get('restrict_user_list_visibility')) is not None:
+            args['restrict_user_list_visibility'] = restrict_user_list_visibility
         if (allowed_ip_addresses := _dict.get('allowed_ip_addresses')) is not None:
             args['allowed_ip_addresses'] = allowed_ip_addresses
         if (mfa := _dict.get('mfa')) is not None:
             args['mfa'] = mfa
         if (user_mfa := _dict.get('user_mfa')) is not None:
-            args['user_mfa'] = [EffectiveAccountSettingsUserMFA.from_dict(v) for v in user_mfa]
+            args['user_mfa'] = [AccountSettingsUserMFAResponse.from_dict(v) for v in user_mfa]
         if (session_expiration_in_seconds := _dict.get('session_expiration_in_seconds')) is not None:
             args['session_expiration_in_seconds'] = session_expiration_in_seconds
         if (session_invalidation_in_seconds := _dict.get('session_invalidation_in_seconds')) is not None:
@@ -6727,6 +6547,8 @@ class AccountSettingsEffectiveSection:
             _dict['restrict_create_service_id'] = self.restrict_create_service_id
         if hasattr(self, 'restrict_create_platform_apikey') and self.restrict_create_platform_apikey is not None:
             _dict['restrict_create_platform_apikey'] = self.restrict_create_platform_apikey
+        if hasattr(self, 'restrict_user_list_visibility') and self.restrict_user_list_visibility is not None:
+            _dict['restrict_user_list_visibility'] = self.restrict_user_list_visibility
         if hasattr(self, 'allowed_ip_addresses') and self.allowed_ip_addresses is not None:
             _dict['allowed_ip_addresses'] = self.allowed_ip_addresses
         if hasattr(self, 'mfa') and self.mfa is not None:
@@ -6777,7 +6599,7 @@ class AccountSettingsEffectiveSection:
 
     class RestrictCreateServiceIdEnum(str, Enum):
         """
-        Defines whether or not creating a service ID is access controlled. Valid values:
+        Defines whether or not creating the resource is access controlled. Valid values:
           * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
         Identity Service can create service IDs, including the account owner
           * NOT_RESTRICTED - all members of an account can create service IDs
@@ -6790,10 +6612,10 @@ class AccountSettingsEffectiveSection:
 
     class RestrictCreatePlatformApikeyEnum(str, Enum):
         """
-        Defines whether or not creating platform API keys is access controlled. Valid
-        values:
-          * RESTRICTED - to apply access control
-          * NOT_RESTRICTED - to remove access control
+        Defines whether or not creating the resource is access controlled. Valid values:
+          * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+        Identity Service can create service IDs, including the account owner
+          * NOT_RESTRICTED - all members of an account can create service IDs
           * NOT_SET - to 'unset' a previous set value.
         """
 
@@ -6801,9 +6623,22 @@ class AccountSettingsEffectiveSection:
         NOT_RESTRICTED = 'NOT_RESTRICTED'
         NOT_SET = 'NOT_SET'
 
+    class RestrictUserListVisibilityEnum(str, Enum):
+        """
+        Defines whether or not user visibility is access controlled. Valid values:
+          * RESTRICTED - users can view only specific types of users in the account, such
+        as those the user has invited to the account, or descendants of those users based
+        on the classic infrastructure hierarchy
+          * NOT_RESTRICTED - any user in the account can view other users from the Users
+        page in IBM Cloud console.
+        """
+
+        NOT_RESTRICTED = 'NOT_RESTRICTED'
+        RESTRICTED = 'RESTRICTED'
+
     class MfaEnum(str, Enum):
         """
-        Defines the MFA requirement for the user. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -6824,26 +6659,39 @@ class AccountSettingsEffectiveSection:
 
 class AccountSettingsResponse:
     """
-    Response body format for Account Settings REST requests.
+    Input body parameters for the Account Settings REST request.
 
     :param ResponseContext context: (optional) Context with key properties for
           problem determination.
     :param str account_id: Unique ID of the account.
-    :param str restrict_create_service_id: Defines whether or not creating a service
-          ID is access controlled. Valid values:
+    :param str entity_tag: Version of the account settings.
+    :param List[EnityHistoryRecord] history: (optional) History of the Account
+          Settings.
+    :param str restrict_create_service_id: Defines whether or not creating the
+          resource is access controlled. Valid values:
             * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
           Identity Service can create service IDs, including the account owner
             * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
-    :param str restrict_create_platform_apikey: Defines whether or not creating
-          platform API keys is access controlled. Valid values:
-            * RESTRICTED - to apply access control
-            * NOT_RESTRICTED - to remove access control
+    :param str restrict_create_platform_apikey: Defines whether or not creating the
+          resource is access controlled. Valid values:
+            * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+          Identity Service can create service IDs, including the account owner
+            * NOT_RESTRICTED - all members of an account can create service IDs
             * NOT_SET - to 'unset' a previous set value.
+    :param str restrict_user_list_visibility: Defines whether or not user visibility
+          is access controlled. Valid values:
+            * RESTRICTED - users can view only specific types of users in the account,
+          such as those the user has invited to the account, or descendants of those users
+          based on the classic infrastructure hierarchy
+            * NOT_RESTRICTED - any user in the account can view other users from the Users
+          page in IBM Cloud console.
+    :param List[AccountSettingsUserDomainRestriction] restrict_user_domains: Defines
+          if account invitations are restricted to specified domains. To remove an entry
+          for a realm_id, perform an update (PUT) request with only the realm_id set.
     :param str allowed_ip_addresses: Defines the IP addresses and subnets from which
           IAM tokens can be created for the account.
-    :param str entity_tag: Version of the account settings.
-    :param str mfa: Defines the MFA trait for the account. Valid values:
+    :param str mfa: MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -6851,10 +6699,6 @@ class AccountSettingsResponse:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param List[AccountSettingsUserMFA] user_mfa: List of users that are exempted
-          from the MFA requirement of the account.
-    :param List[EnityHistoryRecord] history: (optional) History of the Account
-          Settings.
     :param str session_expiration_in_seconds: Defines the session expiration in
           seconds for the account. Valid values:
             * Any whole number between between '900' and '86400'
@@ -6875,22 +6719,26 @@ class AccountSettingsResponse:
           expiration in seconds. Valid values:
             * Any whole number between '900' and '259200'
             * NOT_SET - To unset account setting and use service default.
+    :param List[AccountSettingsUserMFAResponse] user_mfa: List of users that are
+          exempted from the MFA requirement of the account.
     """
 
     def __init__(
         self,
         account_id: str,
+        entity_tag: str,
         restrict_create_service_id: str,
         restrict_create_platform_apikey: str,
+        restrict_user_list_visibility: str,
+        restrict_user_domains: List['AccountSettingsUserDomainRestriction'],
         allowed_ip_addresses: str,
-        entity_tag: str,
         mfa: str,
-        user_mfa: List['AccountSettingsUserMFA'],
         session_expiration_in_seconds: str,
         session_invalidation_in_seconds: str,
         max_sessions_per_identity: str,
         system_access_token_expiration_in_seconds: str,
         system_refresh_token_expiration_in_seconds: str,
+        user_mfa: List['AccountSettingsUserMFAResponse'],
         *,
         context: Optional['ResponseContext'] = None,
         history: Optional[List['EnityHistoryRecord']] = None,
@@ -6899,21 +6747,33 @@ class AccountSettingsResponse:
         Initialize a AccountSettingsResponse object.
 
         :param str account_id: Unique ID of the account.
-        :param str restrict_create_service_id: Defines whether or not creating a
-               service ID is access controlled. Valid values:
+        :param str entity_tag: Version of the account settings.
+        :param str restrict_create_service_id: Defines whether or not creating the
+               resource is access controlled. Valid values:
                  * RESTRICTED - only users assigned the 'Service ID creator' role on the
                IAM Identity Service can create service IDs, including the account owner
                  * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
         :param str restrict_create_platform_apikey: Defines whether or not creating
-               platform API keys is access controlled. Valid values:
-                 * RESTRICTED - to apply access control
-                 * NOT_RESTRICTED - to remove access control
+               the resource is access controlled. Valid values:
+                 * RESTRICTED - only users assigned the 'Service ID creator' role on the
+               IAM Identity Service can create service IDs, including the account owner
+                 * NOT_RESTRICTED - all members of an account can create service IDs
                  * NOT_SET - to 'unset' a previous set value.
+        :param str restrict_user_list_visibility: Defines whether or not user
+               visibility is access controlled. Valid values:
+                 * RESTRICTED - users can view only specific types of users in the
+               account, such as those the user has invited to the account, or descendants
+               of those users based on the classic infrastructure hierarchy
+                 * NOT_RESTRICTED - any user in the account can view other users from the
+               Users page in IBM Cloud console.
+        :param List[AccountSettingsUserDomainRestriction] restrict_user_domains:
+               Defines if account invitations are restricted to specified domains. To
+               remove an entry for a realm_id, perform an update (PUT) request with only
+               the realm_id set.
         :param str allowed_ip_addresses: Defines the IP addresses and subnets from
                which IAM tokens can be created for the account.
-        :param str entity_tag: Version of the account settings.
-        :param str mfa: Defines the MFA trait for the account. Valid values:
+        :param str mfa: MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -6921,8 +6781,6 @@ class AccountSettingsResponse:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param List[AccountSettingsUserMFA] user_mfa: List of users that are
-               exempted from the MFA requirement of the account.
         :param str session_expiration_in_seconds: Defines the session expiration in
                seconds for the account. Valid values:
                  * Any whole number between between '900' and '86400'
@@ -6944,6 +6802,8 @@ class AccountSettingsResponse:
                token expiration in seconds. Valid values:
                  * Any whole number between '900' and '259200'
                  * NOT_SET - To unset account setting and use service default.
+        :param List[AccountSettingsUserMFAResponse] user_mfa: List of users that
+               are exempted from the MFA requirement of the account.
         :param ResponseContext context: (optional) Context with key properties for
                problem determination.
         :param List[EnityHistoryRecord] history: (optional) History of the Account
@@ -6951,18 +6811,20 @@ class AccountSettingsResponse:
         """
         self.context = context
         self.account_id = account_id
+        self.entity_tag = entity_tag
+        self.history = history
         self.restrict_create_service_id = restrict_create_service_id
         self.restrict_create_platform_apikey = restrict_create_platform_apikey
+        self.restrict_user_list_visibility = restrict_user_list_visibility
+        self.restrict_user_domains = restrict_user_domains
         self.allowed_ip_addresses = allowed_ip_addresses
-        self.entity_tag = entity_tag
         self.mfa = mfa
-        self.user_mfa = user_mfa
-        self.history = history
         self.session_expiration_in_seconds = session_expiration_in_seconds
         self.session_invalidation_in_seconds = session_invalidation_in_seconds
         self.max_sessions_per_identity = max_sessions_per_identity
         self.system_access_token_expiration_in_seconds = system_access_token_expiration_in_seconds
         self.system_refresh_token_expiration_in_seconds = system_refresh_token_expiration_in_seconds
+        self.user_mfa = user_mfa
 
     @classmethod
     def from_dict(cls, _dict: Dict) -> 'AccountSettingsResponse':
@@ -6974,6 +6836,12 @@ class AccountSettingsResponse:
             args['account_id'] = account_id
         else:
             raise ValueError('Required property \'account_id\' not present in AccountSettingsResponse JSON')
+        if (entity_tag := _dict.get('entity_tag')) is not None:
+            args['entity_tag'] = entity_tag
+        else:
+            raise ValueError('Required property \'entity_tag\' not present in AccountSettingsResponse JSON')
+        if (history := _dict.get('history')) is not None:
+            args['history'] = [EnityHistoryRecord.from_dict(v) for v in history]
         if (restrict_create_service_id := _dict.get('restrict_create_service_id')) is not None:
             args['restrict_create_service_id'] = restrict_create_service_id
         else:
@@ -6986,24 +6854,26 @@ class AccountSettingsResponse:
             raise ValueError(
                 'Required property \'restrict_create_platform_apikey\' not present in AccountSettingsResponse JSON'
             )
+        if (restrict_user_list_visibility := _dict.get('restrict_user_list_visibility')) is not None:
+            args['restrict_user_list_visibility'] = restrict_user_list_visibility
+        else:
+            raise ValueError(
+                'Required property \'restrict_user_list_visibility\' not present in AccountSettingsResponse JSON'
+            )
+        if (restrict_user_domains := _dict.get('restrict_user_domains')) is not None:
+            args['restrict_user_domains'] = [
+                AccountSettingsUserDomainRestriction.from_dict(v) for v in restrict_user_domains
+            ]
+        else:
+            raise ValueError('Required property \'restrict_user_domains\' not present in AccountSettingsResponse JSON')
         if (allowed_ip_addresses := _dict.get('allowed_ip_addresses')) is not None:
             args['allowed_ip_addresses'] = allowed_ip_addresses
         else:
             raise ValueError('Required property \'allowed_ip_addresses\' not present in AccountSettingsResponse JSON')
-        if (entity_tag := _dict.get('entity_tag')) is not None:
-            args['entity_tag'] = entity_tag
-        else:
-            raise ValueError('Required property \'entity_tag\' not present in AccountSettingsResponse JSON')
         if (mfa := _dict.get('mfa')) is not None:
             args['mfa'] = mfa
         else:
             raise ValueError('Required property \'mfa\' not present in AccountSettingsResponse JSON')
-        if (user_mfa := _dict.get('user_mfa')) is not None:
-            args['user_mfa'] = [AccountSettingsUserMFA.from_dict(v) for v in user_mfa]
-        else:
-            raise ValueError('Required property \'user_mfa\' not present in AccountSettingsResponse JSON')
-        if (history := _dict.get('history')) is not None:
-            args['history'] = [EnityHistoryRecord.from_dict(v) for v in history]
         if (session_expiration_in_seconds := _dict.get('session_expiration_in_seconds')) is not None:
             args['session_expiration_in_seconds'] = session_expiration_in_seconds
         else:
@@ -7038,6 +6908,10 @@ class AccountSettingsResponse:
             raise ValueError(
                 'Required property \'system_refresh_token_expiration_in_seconds\' not present in AccountSettingsResponse JSON'
             )
+        if (user_mfa := _dict.get('user_mfa')) is not None:
+            args['user_mfa'] = [AccountSettingsUserMFAResponse.from_dict(v) for v in user_mfa]
+        else:
+            raise ValueError('Required property \'user_mfa\' not present in AccountSettingsResponse JSON')
         return cls(**args)
 
     @classmethod
@@ -7055,24 +6929,8 @@ class AccountSettingsResponse:
                 _dict['context'] = self.context.to_dict()
         if hasattr(self, 'account_id') and self.account_id is not None:
             _dict['account_id'] = self.account_id
-        if hasattr(self, 'restrict_create_service_id') and self.restrict_create_service_id is not None:
-            _dict['restrict_create_service_id'] = self.restrict_create_service_id
-        if hasattr(self, 'restrict_create_platform_apikey') and self.restrict_create_platform_apikey is not None:
-            _dict['restrict_create_platform_apikey'] = self.restrict_create_platform_apikey
-        if hasattr(self, 'allowed_ip_addresses') and self.allowed_ip_addresses is not None:
-            _dict['allowed_ip_addresses'] = self.allowed_ip_addresses
         if hasattr(self, 'entity_tag') and self.entity_tag is not None:
             _dict['entity_tag'] = self.entity_tag
-        if hasattr(self, 'mfa') and self.mfa is not None:
-            _dict['mfa'] = self.mfa
-        if hasattr(self, 'user_mfa') and self.user_mfa is not None:
-            user_mfa_list = []
-            for v in self.user_mfa:
-                if isinstance(v, dict):
-                    user_mfa_list.append(v)
-                else:
-                    user_mfa_list.append(v.to_dict())
-            _dict['user_mfa'] = user_mfa_list
         if hasattr(self, 'history') and self.history is not None:
             history_list = []
             for v in self.history:
@@ -7081,6 +6939,24 @@ class AccountSettingsResponse:
                 else:
                     history_list.append(v.to_dict())
             _dict['history'] = history_list
+        if hasattr(self, 'restrict_create_service_id') and self.restrict_create_service_id is not None:
+            _dict['restrict_create_service_id'] = self.restrict_create_service_id
+        if hasattr(self, 'restrict_create_platform_apikey') and self.restrict_create_platform_apikey is not None:
+            _dict['restrict_create_platform_apikey'] = self.restrict_create_platform_apikey
+        if hasattr(self, 'restrict_user_list_visibility') and self.restrict_user_list_visibility is not None:
+            _dict['restrict_user_list_visibility'] = self.restrict_user_list_visibility
+        if hasattr(self, 'restrict_user_domains') and self.restrict_user_domains is not None:
+            restrict_user_domains_list = []
+            for v in self.restrict_user_domains:
+                if isinstance(v, dict):
+                    restrict_user_domains_list.append(v)
+                else:
+                    restrict_user_domains_list.append(v.to_dict())
+            _dict['restrict_user_domains'] = restrict_user_domains_list
+        if hasattr(self, 'allowed_ip_addresses') and self.allowed_ip_addresses is not None:
+            _dict['allowed_ip_addresses'] = self.allowed_ip_addresses
+        if hasattr(self, 'mfa') and self.mfa is not None:
+            _dict['mfa'] = self.mfa
         if hasattr(self, 'session_expiration_in_seconds') and self.session_expiration_in_seconds is not None:
             _dict['session_expiration_in_seconds'] = self.session_expiration_in_seconds
         if hasattr(self, 'session_invalidation_in_seconds') and self.session_invalidation_in_seconds is not None:
@@ -7097,6 +6973,14 @@ class AccountSettingsResponse:
             and self.system_refresh_token_expiration_in_seconds is not None
         ):
             _dict['system_refresh_token_expiration_in_seconds'] = self.system_refresh_token_expiration_in_seconds
+        if hasattr(self, 'user_mfa') and self.user_mfa is not None:
+            user_mfa_list = []
+            for v in self.user_mfa:
+                if isinstance(v, dict):
+                    user_mfa_list.append(v)
+                else:
+                    user_mfa_list.append(v.to_dict())
+            _dict['user_mfa'] = user_mfa_list
         return _dict
 
     def _to_dict(self):
@@ -7119,7 +7003,7 @@ class AccountSettingsResponse:
 
     class RestrictCreateServiceIdEnum(str, Enum):
         """
-        Defines whether or not creating a service ID is access controlled. Valid values:
+        Defines whether or not creating the resource is access controlled. Valid values:
           * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
         Identity Service can create service IDs, including the account owner
           * NOT_RESTRICTED - all members of an account can create service IDs
@@ -7132,10 +7016,10 @@ class AccountSettingsResponse:
 
     class RestrictCreatePlatformApikeyEnum(str, Enum):
         """
-        Defines whether or not creating platform API keys is access controlled. Valid
-        values:
-          * RESTRICTED - to apply access control
-          * NOT_RESTRICTED - to remove access control
+        Defines whether or not creating the resource is access controlled. Valid values:
+          * RESTRICTED - only users assigned the 'Service ID creator' role on the IAM
+        Identity Service can create service IDs, including the account owner
+          * NOT_RESTRICTED - all members of an account can create service IDs
           * NOT_SET - to 'unset' a previous set value.
         """
 
@@ -7143,9 +7027,22 @@ class AccountSettingsResponse:
         NOT_RESTRICTED = 'NOT_RESTRICTED'
         NOT_SET = 'NOT_SET'
 
+    class RestrictUserListVisibilityEnum(str, Enum):
+        """
+        Defines whether or not user visibility is access controlled. Valid values:
+          * RESTRICTED - users can view only specific types of users in the account, such
+        as those the user has invited to the account, or descendants of those users based
+        on the classic infrastructure hierarchy
+          * NOT_RESTRICTED - any user in the account can view other users from the Users
+        page in IBM Cloud console.
+        """
+
+        NOT_RESTRICTED = 'NOT_RESTRICTED'
+        RESTRICTED = 'RESTRICTED'
+
     class MfaEnum(str, Enum):
         """
-        Defines the MFA trait for the account. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -7483,26 +7380,113 @@ class AccountSettingsTemplateResponse:
         return self.to_dict()
 
     def __str__(self) -> str:
-        """Return a `str` version of this AccountSettingsTemplateResponse object."""
+        """Return a `str` version of this AccountSettingsTemplateResponse object."""
+        return json.dumps(self.to_dict(), indent=2)
+
+    def __eq__(self, other: 'AccountSettingsTemplateResponse') -> bool:
+        """Return `true` when self and other are equal, false otherwise."""
+        if not isinstance(other, self.__class__):
+            return False
+        return self.__dict__ == other.__dict__
+
+    def __ne__(self, other: 'AccountSettingsTemplateResponse') -> bool:
+        """Return `true` when self and other are not equal, false otherwise."""
+        return not self == other
+
+
+class AccountSettingsUserDomainRestriction:
+    """
+    Input body parameters for the Account Settings REST request.
+
+    :param str realm_id: The realm that the restrictions apply to.
+    :param List[str] invitation_email_allow_patterns: (optional) The list of allowed
+          email patterns. Wildcard syntax is supported, '*' represents any sequence of
+          zero or more characters in the string, except for '.' and '@'. The sequence ends
+          if a '.' or '@' was found. '**' represents any sequence of zero or more
+          characters in the string - without limit.
+    :param bool restrict_invitation: (optional) When true invites will only be
+          possible to the domain patterns provided, otherwise invites are unrestricted.
+    """
+
+    def __init__(
+        self,
+        realm_id: str,
+        *,
+        invitation_email_allow_patterns: Optional[List[str]] = None,
+        restrict_invitation: Optional[bool] = None,
+    ) -> None:
+        """
+        Initialize a AccountSettingsUserDomainRestriction object.
+
+        :param str realm_id: The realm that the restrictions apply to.
+        :param List[str] invitation_email_allow_patterns: (optional) The list of
+               allowed email patterns. Wildcard syntax is supported, '*' represents any
+               sequence of zero or more characters in the string, except for '.' and '@'.
+               The sequence ends if a '.' or '@' was found. '**' represents any sequence
+               of zero or more characters in the string - without limit.
+        :param bool restrict_invitation: (optional) When true invites will only be
+               possible to the domain patterns provided, otherwise invites are
+               unrestricted.
+        """
+        self.realm_id = realm_id
+        self.invitation_email_allow_patterns = invitation_email_allow_patterns
+        self.restrict_invitation = restrict_invitation
+
+    @classmethod
+    def from_dict(cls, _dict: Dict) -> 'AccountSettingsUserDomainRestriction':
+        """Initialize a AccountSettingsUserDomainRestriction object from a json dictionary."""
+        args = {}
+        if (realm_id := _dict.get('realm_id')) is not None:
+            args['realm_id'] = realm_id
+        else:
+            raise ValueError('Required property \'realm_id\' not present in AccountSettingsUserDomainRestriction JSON')
+        if (invitation_email_allow_patterns := _dict.get('invitation_email_allow_patterns')) is not None:
+            args['invitation_email_allow_patterns'] = invitation_email_allow_patterns
+        if (restrict_invitation := _dict.get('restrict_invitation')) is not None:
+            args['restrict_invitation'] = restrict_invitation
+        return cls(**args)
+
+    @classmethod
+    def _from_dict(cls, _dict):
+        """Initialize a AccountSettingsUserDomainRestriction object from a json dictionary."""
+        return cls.from_dict(_dict)
+
+    def to_dict(self) -> Dict:
+        """Return a json dictionary representing this model."""
+        _dict = {}
+        if hasattr(self, 'realm_id') and self.realm_id is not None:
+            _dict['realm_id'] = self.realm_id
+        if hasattr(self, 'invitation_email_allow_patterns') and self.invitation_email_allow_patterns is not None:
+            _dict['invitation_email_allow_patterns'] = self.invitation_email_allow_patterns
+        if hasattr(self, 'restrict_invitation') and self.restrict_invitation is not None:
+            _dict['restrict_invitation'] = self.restrict_invitation
+        return _dict
+
+    def _to_dict(self):
+        """Return a json dictionary representing this model."""
+        return self.to_dict()
+
+    def __str__(self) -> str:
+        """Return a `str` version of this AccountSettingsUserDomainRestriction object."""
         return json.dumps(self.to_dict(), indent=2)
 
-    def __eq__(self, other: 'AccountSettingsTemplateResponse') -> bool:
+    def __eq__(self, other: 'AccountSettingsUserDomainRestriction') -> bool:
         """Return `true` when self and other are equal, false otherwise."""
         if not isinstance(other, self.__class__):
             return False
         return self.__dict__ == other.__dict__
 
-    def __ne__(self, other: 'AccountSettingsTemplateResponse') -> bool:
+    def __ne__(self, other: 'AccountSettingsUserDomainRestriction') -> bool:
         """Return `true` when self and other are not equal, false otherwise."""
         return not self == other
 
 
-class AccountSettingsUserMFA:
+class AccountSettingsUserMFAResponse:
     """
-    AccountSettingsUserMFA.
+    AccountSettingsUserMFAResponse.
 
     :param str iam_id: The iam_id of the user.
-    :param str mfa: Defines the MFA requirement for the user. Valid values:
+    :param str mfa: MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -7510,18 +7494,27 @@ class AccountSettingsUserMFA:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
+    :param str name: (optional) name of the user account.
+    :param str user_name: (optional) userName of the user.
+    :param str email: (optional) email of the user.
+    :param str description: (optional) optional description.
     """
 
     def __init__(
         self,
         iam_id: str,
         mfa: str,
+        *,
+        name: Optional[str] = None,
+        user_name: Optional[str] = None,
+        email: Optional[str] = None,
+        description: Optional[str] = None,
     ) -> None:
         """
-        Initialize a AccountSettingsUserMFA object.
+        Initialize a AccountSettingsUserMFAResponse object.
 
         :param str iam_id: The iam_id of the user.
-        :param str mfa: Defines the MFA requirement for the user. Valid values:
+        :param str mfa: MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -7529,27 +7522,43 @@ class AccountSettingsUserMFA:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
+        :param str name: (optional) name of the user account.
+        :param str user_name: (optional) userName of the user.
+        :param str email: (optional) email of the user.
+        :param str description: (optional) optional description.
         """
         self.iam_id = iam_id
         self.mfa = mfa
+        self.name = name
+        self.user_name = user_name
+        self.email = email
+        self.description = description
 
     @classmethod
-    def from_dict(cls, _dict: Dict) -> 'AccountSettingsUserMFA':
-        """Initialize a AccountSettingsUserMFA object from a json dictionary."""
+    def from_dict(cls, _dict: Dict) -> 'AccountSettingsUserMFAResponse':
+        """Initialize a AccountSettingsUserMFAResponse object from a json dictionary."""
         args = {}
         if (iam_id := _dict.get('iam_id')) is not None:
             args['iam_id'] = iam_id
         else:
-            raise ValueError('Required property \'iam_id\' not present in AccountSettingsUserMFA JSON')
+            raise ValueError('Required property \'iam_id\' not present in AccountSettingsUserMFAResponse JSON')
         if (mfa := _dict.get('mfa')) is not None:
             args['mfa'] = mfa
         else:
-            raise ValueError('Required property \'mfa\' not present in AccountSettingsUserMFA JSON')
+            raise ValueError('Required property \'mfa\' not present in AccountSettingsUserMFAResponse JSON')
+        if (name := _dict.get('name')) is not None:
+            args['name'] = name
+        if (user_name := _dict.get('userName')) is not None:
+            args['user_name'] = user_name
+        if (email := _dict.get('email')) is not None:
+            args['email'] = email
+        if (description := _dict.get('description')) is not None:
+            args['description'] = description
         return cls(**args)
 
     @classmethod
     def _from_dict(cls, _dict):
-        """Initialize a AccountSettingsUserMFA object from a json dictionary."""
+        """Initialize a AccountSettingsUserMFAResponse object from a json dictionary."""
         return cls.from_dict(_dict)
 
     def to_dict(self) -> Dict:
@@ -7559,6 +7568,14 @@ class AccountSettingsUserMFA:
             _dict['iam_id'] = self.iam_id
         if hasattr(self, 'mfa') and self.mfa is not None:
             _dict['mfa'] = self.mfa
+        if hasattr(self, 'name') and self.name is not None:
+            _dict['name'] = self.name
+        if hasattr(self, 'user_name') and self.user_name is not None:
+            _dict['userName'] = self.user_name
+        if hasattr(self, 'email') and self.email is not None:
+            _dict['email'] = self.email
+        if hasattr(self, 'description') and self.description is not None:
+            _dict['description'] = self.description
         return _dict
 
     def _to_dict(self):
@@ -7566,22 +7583,22 @@ class AccountSettingsUserMFA:
         return self.to_dict()
 
     def __str__(self) -> str:
-        """Return a `str` version of this AccountSettingsUserMFA object."""
+        """Return a `str` version of this AccountSettingsUserMFAResponse object."""
         return json.dumps(self.to_dict(), indent=2)
 
-    def __eq__(self, other: 'AccountSettingsUserMFA') -> bool:
+    def __eq__(self, other: 'AccountSettingsUserMFAResponse') -> bool:
         """Return `true` when self and other are equal, false otherwise."""
         if not isinstance(other, self.__class__):
             return False
         return self.__dict__ == other.__dict__
 
-    def __ne__(self, other: 'AccountSettingsUserMFA') -> bool:
+    def __ne__(self, other: 'AccountSettingsUserMFAResponse') -> bool:
         """Return `true` when self and other are not equal, false otherwise."""
         return not self == other
 
     class MfaEnum(str, Enum):
         """
-        Defines the MFA requirement for the user. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -8840,7 +8857,8 @@ class EffectiveAccountSettingsResponse:
           problem determination.
     :param str account_id: Unique ID of the account.
     :param AccountSettingsEffectiveSection effective:
-    :param AccountSettingsAccountSection account:
+    :param AccountSettingsResponse account: Input body parameters for the Account
+          Settings REST request.
     :param List[AccountSettingsAssignedTemplatesSection] assigned_templates:
           (optional) assigned template section.
     """
@@ -8849,7 +8867,7 @@ class EffectiveAccountSettingsResponse:
         self,
         account_id: str,
         effective: 'AccountSettingsEffectiveSection',
-        account: 'AccountSettingsAccountSection',
+        account: 'AccountSettingsResponse',
         *,
         context: Optional['ResponseContext'] = None,
         assigned_templates: Optional[List['AccountSettingsAssignedTemplatesSection']] = None,
@@ -8859,7 +8877,8 @@ class EffectiveAccountSettingsResponse:
 
         :param str account_id: Unique ID of the account.
         :param AccountSettingsEffectiveSection effective:
-        :param AccountSettingsAccountSection account:
+        :param AccountSettingsResponse account: Input body parameters for the
+               Account Settings REST request.
         :param ResponseContext context: (optional) Context with key properties for
                problem determination.
         :param List[AccountSettingsAssignedTemplatesSection] assigned_templates:
@@ -8886,7 +8905,7 @@ class EffectiveAccountSettingsResponse:
         else:
             raise ValueError('Required property \'effective\' not present in EffectiveAccountSettingsResponse JSON')
         if (account := _dict.get('account')) is not None:
-            args['account'] = AccountSettingsAccountSection.from_dict(account)
+            args['account'] = AccountSettingsResponse.from_dict(account)
         else:
             raise ValueError('Required property \'account\' not present in EffectiveAccountSettingsResponse JSON')
         if (assigned_templates := _dict.get('assigned_templates')) is not None:
@@ -8949,142 +8968,6 @@ class EffectiveAccountSettingsResponse:
         return not self == other
 
 
-class EffectiveAccountSettingsUserMFA:
-    """
-    EffectiveAccountSettingsUserMFA.
-
-    :param str iam_id: The iam_id of the user.
-    :param str mfa: Defines the MFA requirement for the user. Valid values:
-            * NONE - No MFA trait set
-            * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-            * TOTP - For all non-federated IBMId users
-            * TOTP4ALL - For all users
-            * LEVEL1 - Email-based MFA for all users
-            * LEVEL2 - TOTP-based MFA for all users
-            * LEVEL3 - U2F MFA for all users.
-    :param str name: (optional) name of the user account.
-    :param str user_name: (optional) userName of the user.
-    :param str email: (optional) email of the user.
-    :param str description: (optional) optional description.
-    """
-
-    def __init__(
-        self,
-        iam_id: str,
-        mfa: str,
-        *,
-        name: Optional[str] = None,
-        user_name: Optional[str] = None,
-        email: Optional[str] = None,
-        description: Optional[str] = None,
-    ) -> None:
-        """
-        Initialize a EffectiveAccountSettingsUserMFA object.
-
-        :param str iam_id: The iam_id of the user.
-        :param str mfa: Defines the MFA requirement for the user. Valid values:
-                 * NONE - No MFA trait set
-                 * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-                 * TOTP - For all non-federated IBMId users
-                 * TOTP4ALL - For all users
-                 * LEVEL1 - Email-based MFA for all users
-                 * LEVEL2 - TOTP-based MFA for all users
-                 * LEVEL3 - U2F MFA for all users.
-        :param str name: (optional) name of the user account.
-        :param str user_name: (optional) userName of the user.
-        :param str email: (optional) email of the user.
-        :param str description: (optional) optional description.
-        """
-        self.iam_id = iam_id
-        self.mfa = mfa
-        self.name = name
-        self.user_name = user_name
-        self.email = email
-        self.description = description
-
-    @classmethod
-    def from_dict(cls, _dict: Dict) -> 'EffectiveAccountSettingsUserMFA':
-        """Initialize a EffectiveAccountSettingsUserMFA object from a json dictionary."""
-        args = {}
-        if (iam_id := _dict.get('iam_id')) is not None:
-            args['iam_id'] = iam_id
-        else:
-            raise ValueError('Required property \'iam_id\' not present in EffectiveAccountSettingsUserMFA JSON')
-        if (mfa := _dict.get('mfa')) is not None:
-            args['mfa'] = mfa
-        else:
-            raise ValueError('Required property \'mfa\' not present in EffectiveAccountSettingsUserMFA JSON')
-        if (name := _dict.get('name')) is not None:
-            args['name'] = name
-        if (user_name := _dict.get('userName')) is not None:
-            args['user_name'] = user_name
-        if (email := _dict.get('email')) is not None:
-            args['email'] = email
-        if (description := _dict.get('description')) is not None:
-            args['description'] = description
-        return cls(**args)
-
-    @classmethod
-    def _from_dict(cls, _dict):
-        """Initialize a EffectiveAccountSettingsUserMFA object from a json dictionary."""
-        return cls.from_dict(_dict)
-
-    def to_dict(self) -> Dict:
-        """Return a json dictionary representing this model."""
-        _dict = {}
-        if hasattr(self, 'iam_id') and self.iam_id is not None:
-            _dict['iam_id'] = self.iam_id
-        if hasattr(self, 'mfa') and self.mfa is not None:
-            _dict['mfa'] = self.mfa
-        if hasattr(self, 'name') and self.name is not None:
-            _dict['name'] = self.name
-        if hasattr(self, 'user_name') and self.user_name is not None:
-            _dict['userName'] = self.user_name
-        if hasattr(self, 'email') and self.email is not None:
-            _dict['email'] = self.email
-        if hasattr(self, 'description') and self.description is not None:
-            _dict['description'] = self.description
-        return _dict
-
-    def _to_dict(self):
-        """Return a json dictionary representing this model."""
-        return self.to_dict()
-
-    def __str__(self) -> str:
-        """Return a `str` version of this EffectiveAccountSettingsUserMFA object."""
-        return json.dumps(self.to_dict(), indent=2)
-
-    def __eq__(self, other: 'EffectiveAccountSettingsUserMFA') -> bool:
-        """Return `true` when self and other are equal, false otherwise."""
-        if not isinstance(other, self.__class__):
-            return False
-        return self.__dict__ == other.__dict__
-
-    def __ne__(self, other: 'EffectiveAccountSettingsUserMFA') -> bool:
-        """Return `true` when self and other are not equal, false otherwise."""
-        return not self == other
-
-    class MfaEnum(str, Enum):
-        """
-        Defines the MFA requirement for the user. Valid values:
-          * NONE - No MFA trait set
-          * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
-          * TOTP - For all non-federated IBMId users
-          * TOTP4ALL - For all users
-          * LEVEL1 - Email-based MFA for all users
-          * LEVEL2 - TOTP-based MFA for all users
-          * LEVEL3 - U2F MFA for all users.
-        """
-
-        NONE = 'NONE'
-        NONE_NO_ROPC = 'NONE_NO_ROPC'
-        TOTP = 'TOTP'
-        TOTP4ALL = 'TOTP4ALL'
-        LEVEL1 = 'LEVEL1'
-        LEVEL2 = 'LEVEL2'
-        LEVEL3 = 'LEVEL3'
-
-
 class EnityHistoryRecord:
     """
     Response body format for an entity history record.
@@ -9467,8 +9350,7 @@ class IdBasedMfaEnrollment:
     """
     IdBasedMfaEnrollment.
 
-    :param str trait_account_default: Defines the MFA trait for the account. Valid
-          values:
+    :param str trait_account_default: MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -9476,8 +9358,7 @@ class IdBasedMfaEnrollment:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param str trait_user_specific: (optional) Defines the MFA trait for the
-          account. Valid values:
+    :param str trait_user_specific: (optional) MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -9485,7 +9366,7 @@ class IdBasedMfaEnrollment:
             * LEVEL1 - Email-based MFA for all users
             * LEVEL2 - TOTP-based MFA for all users
             * LEVEL3 - U2F MFA for all users.
-    :param str trait_effective: Defines the MFA trait for the account. Valid values:
+    :param str trait_effective: MFA trait definitions as follows:
             * NONE - No MFA trait set
             * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
             * TOTP - For all non-federated IBMId users
@@ -9515,8 +9396,7 @@ class IdBasedMfaEnrollment:
         """
         Initialize a IdBasedMfaEnrollment object.
 
-        :param str trait_account_default: Defines the MFA trait for the account.
-               Valid values:
+        :param str trait_account_default: MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -9524,8 +9404,7 @@ class IdBasedMfaEnrollment:
                  * LEVEL1 - Email-based MFA for all users
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
-        :param str trait_effective: Defines the MFA trait for the account. Valid
-               values:
+        :param str trait_effective: MFA trait definitions as follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -9534,8 +9413,8 @@ class IdBasedMfaEnrollment:
                  * LEVEL2 - TOTP-based MFA for all users
                  * LEVEL3 - U2F MFA for all users.
         :param bool complies: The enrollment complies to the effective requirement.
-        :param str trait_user_specific: (optional) Defines the MFA trait for the
-               account. Valid values:
+        :param str trait_user_specific: (optional) MFA trait definitions as
+               follows:
                  * NONE - No MFA trait set
                  * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
                  * TOTP - For all non-federated IBMId users
@@ -9619,7 +9498,7 @@ class IdBasedMfaEnrollment:
 
     class TraitAccountDefaultEnum(str, Enum):
         """
-        Defines the MFA trait for the account. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -9639,7 +9518,7 @@ class IdBasedMfaEnrollment:
 
     class TraitUserSpecificEnum(str, Enum):
         """
-        Defines the MFA trait for the account. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -9659,7 +9538,7 @@ class IdBasedMfaEnrollment:
 
     class TraitEffectiveEnum(str, Enum):
         """
-        Defines the MFA trait for the account. Valid values:
+        MFA trait definitions as follows:
           * NONE - No MFA trait set
           * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
           * TOTP - For all non-federated IBMId users
@@ -13980,6 +13859,106 @@ class UserActivity:
         return not self == other
 
 
+class UserMfa:
+    """
+    UserMfa.
+
+    :param str iam_id: (optional) The iam_id of the user.
+    :param str mfa: (optional) MFA trait definitions as follows:
+            * NONE - No MFA trait set
+            * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
+            * TOTP - For all non-federated IBMId users
+            * TOTP4ALL - For all users
+            * LEVEL1 - Email-based MFA for all users
+            * LEVEL2 - TOTP-based MFA for all users
+            * LEVEL3 - U2F MFA for all users.
+    """
+
+    def __init__(
+        self,
+        *,
+        iam_id: Optional[str] = None,
+        mfa: Optional[str] = None,
+    ) -> None:
+        """
+        Initialize a UserMfa object.
+
+        :param str iam_id: (optional) The iam_id of the user.
+        :param str mfa: (optional) MFA trait definitions as follows:
+                 * NONE - No MFA trait set
+                 * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
+                 * TOTP - For all non-federated IBMId users
+                 * TOTP4ALL - For all users
+                 * LEVEL1 - Email-based MFA for all users
+                 * LEVEL2 - TOTP-based MFA for all users
+                 * LEVEL3 - U2F MFA for all users.
+        """
+        self.iam_id = iam_id
+        self.mfa = mfa
+
+    @classmethod
+    def from_dict(cls, _dict: Dict) -> 'UserMfa':
+        """Initialize a UserMfa object from a json dictionary."""
+        args = {}
+        if (iam_id := _dict.get('iam_id')) is not None:
+            args['iam_id'] = iam_id
+        if (mfa := _dict.get('mfa')) is not None:
+            args['mfa'] = mfa
+        return cls(**args)
+
+    @classmethod
+    def _from_dict(cls, _dict):
+        """Initialize a UserMfa object from a json dictionary."""
+        return cls.from_dict(_dict)
+
+    def to_dict(self) -> Dict:
+        """Return a json dictionary representing this model."""
+        _dict = {}
+        if hasattr(self, 'iam_id') and self.iam_id is not None:
+            _dict['iam_id'] = self.iam_id
+        if hasattr(self, 'mfa') and self.mfa is not None:
+            _dict['mfa'] = self.mfa
+        return _dict
+
+    def _to_dict(self):
+        """Return a json dictionary representing this model."""
+        return self.to_dict()
+
+    def __str__(self) -> str:
+        """Return a `str` version of this UserMfa object."""
+        return json.dumps(self.to_dict(), indent=2)
+
+    def __eq__(self, other: 'UserMfa') -> bool:
+        """Return `true` when self and other are equal, false otherwise."""
+        if not isinstance(other, self.__class__):
+            return False
+        return self.__dict__ == other.__dict__
+
+    def __ne__(self, other: 'UserMfa') -> bool:
+        """Return `true` when self and other are not equal, false otherwise."""
+        return not self == other
+
+    class MfaEnum(str, Enum):
+        """
+        MFA trait definitions as follows:
+          * NONE - No MFA trait set
+          * NONE_NO_ROPC- No MFA, disable CLI logins with only a password
+          * TOTP - For all non-federated IBMId users
+          * TOTP4ALL - For all users
+          * LEVEL1 - Email-based MFA for all users
+          * LEVEL2 - TOTP-based MFA for all users
+          * LEVEL3 - U2F MFA for all users.
+        """
+
+        NONE = 'NONE'
+        NONE_NO_ROPC = 'NONE_NO_ROPC'
+        TOTP = 'TOTP'
+        TOTP4ALL = 'TOTP4ALL'
+        LEVEL1 = 'LEVEL1'
+        LEVEL2 = 'LEVEL2'
+        LEVEL3 = 'LEVEL3'
+
+
 class UserMfaEnrollments:
     """
     UserMfaEnrollments.